OWASP Top 10:2025 · apply · about 10 minutes

The questionnaire that asks for compliance

A prospective customer's security questionnaire has one line on application security: "Confirm your application is compliant with the OWASP Top 10." Your head of sales wants a yes. Your last pentest found two A01 issues, both fixed, and your SCA tool is clean. Nobody has threat-modelled the product. You have centralised logging and no alert rules. Draft the answer, and brief sales on what you are and are not saying.

Write both: the answer that goes in the box, and two sentences for sales. Do not write a yes you cannot defend.

Write your answer somewhere else — on paper, in a mail draft, out loud to someone. Then come back and mark it against the rubric. The rubric is disputable: if you think a line is wrong for your situation, you are probably right, and noticing that is worth more than the tick.

Mark it against the rubric

Says plainly that there is nothing to be compliant with — it is an awareness document, not a standard It is an awareness document, not a standard
Names the edition rather than answering about "the OWASP Top 10" in the abstract Say which edition you mean
Does not offer the clean SCA report as coverage of A03 — it reaches a fraction of it A03: Software Supply Chain Failures
Volunteers the A09 gap: logging without alerting is the category, not an exemption from it A09: logging without alerting is worth little
Flags the absence of threat modelling against A06 rather than hoping it is not asked A06: insecure design slid, for a good reason
Offers something verifiable instead — what is tested, how often, against which standard Ten categories are not application security

Read against OWASP Top 10:2025 on 2026-10-16. Regulations and frameworks change; the date is there so you can tell whether this has kept up.

The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.