What Is the OWASP Top 10?
Think of the OWASP Top 10 as a "most wanted" list for web application vulnerabilities — the ten categories of security flaws that attackers exploit most frequently, most successfully, and with the most damaging results. Published by the Open Web Application Security Project (OWASP), a nonprofit foundation dedicated to improving software security, the list is updated roughly every three to four years based on real-world data from hundreds of organizations and thousands of applications.
The list is not exhaustive. There are hundreds of known vulnerability classes. But the Top 10 represents the intersection of three brutal realities: these flaws are common (found in a huge percentage of applications), exploitable (attackers have reliable, often automated techniques to abuse them), and impactful (successful exploitation leads to data breaches, account takeovers, or full system compromise).
It's an Awareness Document, Not a Compliance Checklist
A common mistake is treating the OWASP Top 10 as a binary checklist — "Are we OWASP compliant?" — and moving on once each box is ticked. OWASP itself explicitly calls it an awareness document. The goal is to shift how developers think about code: every input is potentially hostile, every trust boundary must be enforced, and security is a property of the system, not a feature added at the end.
The 2021 edition (the current version as of this writing) reorganized the list significantly. Broken Access Control moved to #1, reflecting how pervasive authorization failures have become. Injection dropped to #3 but remains one of the most well-understood and devastating attack classes. The list also added Server-Side Request Forgery (SSRF) for the first time, acknowledging the explosion of cloud-native architectures where internal metadata services are a prime target.
The Ten Categories (2021 Edition)
| Rank | Category | Core Risk |
|---|---|---|
| A01 | Broken Access Control | Users acting outside their permissions |
| A02 | Cryptographic Failures | Sensitive data exposed due to weak/missing encryption |
| A03 | Injection | Untrusted data executed as code |
| A04 | Insecure Design | Architectural flaws that no implementation fix can solve |
| A05 | Security Misconfiguration | Default credentials, open cloud storage, verbose errors |
| A06 | Vulnerable & Outdated Components | Dependencies with known CVEs |
| A07 | Identification & Authentication Failures | Broken login, session management |
| A08 | Software & Data Integrity Failures | Unsigned updates, insecure CI/CD pipelines |
| A09 | Security Logging & Monitoring Failures | Attacks go undetected |
| A10 | Server-Side Request Forgery (SSRF) | Server fetches attacker-controlled URLs |
This lesson focuses on the four categories with the highest real-world attack frequency and the clearest engineering mitigations: Injection (A03), Broken Access Control (A01), Cross-Site Scripting — a subset of Injection (A03), and SSRF (A10).