Skip to content
11/14GuidelineGuidance only

OWASP ASVS / OWASP Top 10

The reference for building and testing secure applications.

What it is

The OWASP Top 10 is an awareness list of the most critical web-application risks. The Application Security Verification Standard (ASVS) is a detailed, leveled set of requirements for verifying the technical security controls of web apps and APIs. Together they guide secure coding, code review, and penetration testing.

Certifiable?

No — a testing/requirements standard, not a certification.

Where it's used

Software development, web apps, APIs, secure coding, pentesting.

Effort level

Integrates into the SDLC; scales by ASVS level.

Typical trigger

You build software and need a concrete secure-development bar.

Related frameworks

Complements the org-level frameworks with app-level depth.

Why it matters

OWASP standards define what 'secure software' means at a technical level. The Top 10 raises awareness of critical risks, while ASVS provides a measurable bar for verifying that applications are built securely.

When is it needed?

When building web applications or APIs, when penetration testers need a testing standard, when code review processes need a reference, or when a customer asks about your application security posture.

Use cases

  • Secure software development lifecycle (SSDLC)
  • Penetration testing scope and methodology
  • Code review against recognized security requirements
  • Vendor security assessments for custom software
  • Training developers on secure coding practices

Who asks for it?

  • Security teams defining SSDLC requirements
  • Penetration testing firms scoping engagements
  • Enterprise buyers assessing custom software
  • Development teams building secure-by-default practices
  • Compliance teams requiring application-layer evidence

Benefits

  • Free, open-source, community-maintained
  • The global standard for application security requirements
  • ASVS levels (1–3) scale to risk tolerance
  • Practical — tied to real vulnerabilities, not abstract risks
  • Integrates into CI/CD and automated testing
  • Complements organizational frameworks with app-layer depth

Legal requirements

Not legally mandated, but referenced by PCI DSS (Requirement 6), GDPR guidance on technical measures, and many industry-specific secure development requirements.

Key control areas

Authentication and session management
Access control and authorization
Input validation and output encoding
Cryptographic practices
Error handling and logging
Data protection and privacy
API security and communications

Want to see how Compscan maps your environment to OWASP ASVS / OWASP Top 10?