The ranking is not your priority order
The order reflects industry-wide averages of incidence, exploitability and impact across contributed data. It does not describe your application, your threat model or your data. A05 at fifth may be your single largest exposure.
Why it is like this
An average over tens of thousands of applications is the only ranking that can be produced centrally. Turning it into your backlog order substitutes somebody else's estate for yours.
Not to be confused with
A remediation sequence. Used that way it systematically under-prioritises whatever is rare in general and severe for you — which is most of what actually causes incidents.
In practice
The right use is as a checklist of *questions to ask about your own system*, answered with your own data.
Source: OWASP Top 10:2025 — Introduction, Methodology. Read on .
The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.
Odd one out Check yourself
Three of these are reasonable uses of the Top 10. Which is not?
Show the answer
The order in which to fix your open findings
The ranking is an industry average. Your fix order comes from your own risk, which is what the first three uses help you work out.