It is an awareness document, not a standard
The Top 10 is a standard awareness document describing the most critical security risks to web applications. It is not a specification, not a certification scheme and not a complete list of what can go wrong — ten categories cannot cover application security, and the project does not claim they do.
Why it is like this
It exists to move a conversation: to give developers and executives a short, shared vocabulary for the risks that recur most. A short list is useful precisely because it is not exhaustive.
Not to be confused with
A compliance baseline. There is nothing to be compliant *with* — no clauses, no controls, no pass mark. OWASP itself points people at the Application Security Verification Standard when they want something to verify against.
In practice
"We are OWASP Top 10 compliant" is a sentence with no meaning. The nearest true statement is "we test for the categories in the Top 10", which is a much smaller claim.
Source: OWASP Top 10:2025 — Introduction. Read on .
The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.
Predict Check yourself
A supplier's security questionnaire asks you to confirm compliance with the OWASP Top 10. What is the honest answer?
Show the answer
There is nothing to comply with — it is an awareness document, not a standard. Offer what you do test for, or point at a verification standard such as ASVS.
The question is extremely common and is always malformed. Answering it straight is more useful than playing along.