THREATNOIR
Subscribe
Control frameworks and standards

OWASP

Open application security standards and guides: the Top 10, ASVS, SAMM and more.

Official source Published by OWASP Foundation. Open licence; we summarise in our own words.

What it is

OWASP is an open community that publishes free application security resources. Its best known projects are the OWASP Top 10 awareness list, the Application Security Verification Standard (ASVS) and the Software Assurance Maturity Model (SAMM), which together cover risks, requirements and programme maturity for software security.

Who it applies to

  • Developers, architects and testers building web, API, mobile and AI applications
  • Application security teams setting secure development requirements
  • Buyers who reference ASVS levels in contracts for software or penetration tests
  • Auditors and assessors who use the Top 10 or ASVS as a reference, for example for secure coding training
Status
Voluntary, openly licensed community projects. Each project is versioned on its own; ASVS version 5.0 was released in 2025, and the Top 10 lists are revised every few years.
Enforcement
Voluntary: OWASP does not certify. Its documents become required in practice when customers, contracts, penetration test scopes or other standards refer to them.

Key points

  • The Top 10 is an awareness document, not a complete standard, so do not treat it as a full requirement set
  • ASVS is the better choice when you need requirements you can test and put into contracts
  • ASVS levels let you scale requirements: a basic level for all applications and higher levels for sensitive ones
  • SAMM helps you assess and improve the development process itself, not individual applications
  • The API Security Top 10 and the Top 10 for LLM applications cover risks that the web Top 10 does not
  • Most resources are free, which makes OWASP a practical first reference for small teams

Where to start

  1. 1Use the Top 10 for developer awareness training
  2. 2Pick an ASVS level per application and add the requirements to your definition of done
  3. 3Run a SAMM assessment to find gaps in your development process
  4. 4Reference ASVS rather than the Top 10 when specifying penetration tests or supplier requirements

How it is structured

OWASP Top 10Awareness list of the most critical web application security risks
ASVSDetailed, testable security requirements for applications in three levels
SAMMMaturity model for building and measuring a software security programme
Other Top 10 listsSeparate lists for APIs, mobile and large language model applications
Cheat Sheet Series and testing guidesPractical guidance for developers and testers

A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.

Items explained (14)

In the order of the framework itself.