Data-informed, not data-driven
Eight entries are ranked from contributed data — twelve categories were ranked and the top eight taken — and two are promoted by a community survey. The project calls this *data-informed, but not blindly data-driven*.
Why it is like this
Data is a record of the past: it takes years for a newly understood weakness to be testable at scale, and only then does it appear in anybody's scan results. The survey slots exist so the list can name a risk the tooling has not caught up with.
Not to be confused with
A pure measurement, or a popularity contest. It is deliberately both — and knowing which entries came in which way tells you how to read them.
In practice
A09 Security Logging and Alerting Failures has been voted in from the survey three times. It barely appears in the data, and that absence is the point rather than a counter-argument.
Source: OWASP Top 10:2025 — Introduction, Methodology. Read on .
The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.
Say it back Check yourself
How are the ten positions filled, and what is the stated reason for not using data alone?
Answer out loud or in writing first, then open the points below.
The points a good answer makes
- Categories are ranked from contributed data
- Two positions are promoted or highlighted from the community survey
- Data looks into the past — it takes weeks to years for a new weakness to become testable at scale and appear in results
- So a survey slot lets the list name a risk before the tooling catches up
This is the single most useful thing to know about the list, because it explains why the ranking is not a measurement.