OWASP ASVS / OWASP Top 10
The reference for building and testing secure applications.
What it is
The OWASP Top 10 is an awareness list of the most critical web-application risks. The Application Security Verification Standard (ASVS) is a detailed, leveled set of requirements for verifying the technical security controls of web apps and APIs. Together they guide secure coding, code review, and penetration testing.
Certifiable?
No — a testing/requirements standard, not a certification.
Where it's used
Software development, web apps, APIs, secure coding, pentesting.
Effort level
Integrates into the SDLC; scales by ASVS level.
Typical trigger
You build software and need a concrete secure-development bar.
Related frameworks
Complements the org-level frameworks with app-level depth.
Why it matters
OWASP standards define what 'secure software' means at a technical level. The Top 10 raises awareness of critical risks, while ASVS provides a measurable bar for verifying that applications are built securely.
When is it needed?
When building web applications or APIs, when penetration testers need a testing standard, when code review processes need a reference, or when a customer asks about your application security posture.
Use cases
- Secure software development lifecycle (SSDLC)
- Penetration testing scope and methodology
- Code review against recognized security requirements
- Vendor security assessments for custom software
- Training developers on secure coding practices
Who asks for it?
- Security teams defining SSDLC requirements
- Penetration testing firms scoping engagements
- Enterprise buyers assessing custom software
- Development teams building secure-by-default practices
- Compliance teams requiring application-layer evidence
Benefits
- Free, open-source, community-maintained
- The global standard for application security requirements
- ASVS levels (1–3) scale to risk tolerance
- Practical — tied to real vulnerabilities, not abstract risks
- Integrates into CI/CD and automated testing
- Complements organizational frameworks with app-layer depth
Legal requirements
Not legally mandated, but referenced by PCI DSS (Requirement 6), GDPR guidance on technical measures, and many industry-specific secure development requirements.
Key control areas
Want to see how Compscan maps your environment to OWASP ASVS / OWASP Top 10?