YTYK You think you know

OWASP Top 10:2025 · pillar 6 of 6

How the list gets misused

Three claims people make with it that it does not support.

  1. 16 The ranking is not your priority order The order reflects industry-wide averages of incidence, exploitability and impact across contributed data. It does not…
  2. 17 Ten categories are not application security The list is deliberately short. Ten categories cannot describe application security, the project says overlap between…
  3. 18 Say which edition you mean Editions differ enough that an unqualified "the OWASP Top 10" is ambiguous. Injection was #1 in 2017, #3 in 2021 and is…

Start this pillar See the whole map

Read against OWASP Top 10:2025 on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.

The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.