OWASP Top 10 Explained
The OWASP Top 10 web vulnerabilities explained for pentest buyers — what each means, why it matters for compliance, and what to look for in your report.
2026-08-28
The OWASP Top 10 is the most widely referenced standard for web application security. As a pentest buyer, understanding these categories helps you evaluate report quality and ensure your testing covers the right ground.
The 2021 OWASP Top 10
| Rank | Category | What it means |
|---|---|---|
| A01 | Broken Access Control | Users access resources they should not — the most common web vulnerability |
| A02 | Cryptographic Failures | Weak encryption, missing TLS, exposed secrets |
| A03 | Injection | SQL, NoSQL, OS command injection through untrusted input |
| A04 | Insecure Design | Architectural flaws missed by standard testing |
| A05 | Security Misconfiguration | Default credentials, unnecessary features, verbose errors |
| A06 | Vulnerable Components | Outdated libraries, known CVEs in dependencies |
| A07 | Auth and Session Failures | Weak passwords, session hijacking, missing MFA |
| A08 | Data Integrity Failures | Software supply chain, insecure deserialization |
| A09 | Logging and Monitoring | Insufficient detection and response capability |
| A10 | SSRF | Server-side request forgery against internal systems |
Why the OWASP Top 10 matters for your pentest
A quality web application pentest should explicitly map findings to OWASP categories. When reviewing a pentest proposal or report, ask:
- Does the testing methodology cover all OWASP Top 10 categories?
- Are findings mapped to specific OWASP classifications?
- Does the remediation guidance include OWASP-specific recommendations?
Compliance and OWASP
Multiple compliance frameworks reference OWASP:
- PCI DSS — Requirement 6.5 requires developers to be trained in secure coding practices, with OWASP as the reference standard
- SOC 2 — Auditors expect testing against industry standards; OWASP is the de facto standard for web apps
- HIPAA — OWASP coverage demonstrates due diligence in technical safeguard evaluation
What Affordable Pentesting covers
Every Affordable Pentesting web application test is mapped to the OWASP Top 10 with detailed findings, proof-of-concept evidence, and remediation guidance. Launch a pentest or view pricing.
Related reading: What a Penetration Test Actually Includes