YTYK You think you know

Card 17 of 18 How the list gets misused ●○○ Foundational

Ten categories are not application security

The list is deliberately short. Ten categories cannot describe application security, the project says overlap between them is unavoidable, and a great deal of real risk — business logic specific to your domain most of all — has no entry at all.

Why it is like this

Short lists get read. A comprehensive one would be accurate and unused, which is why the comprehensive documents are separate projects.

Not to be confused with

The whole of OWASP. ASVS exists for verification, the Testing Guide for method, the Cheat Sheet Series for implementation; the Top 10 is the doorway, not the building.

In practice

"Not on the Top 10" has never meant "not a risk". It frequently means "harder to test for", which the methodology admits openly.

Source: OWASP Top 10:2025 — Introduction. Read on .

The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.

Predict Check yourself

A threat model turns up a serious business-logic flaw that maps to no Top 10 category. What does that tell you?

  1. Nothing about its severity — the list is ten categories chosen for breadth and testability, and domain-specific logic flaws are exactly what it cannot enumerate.
  2. That it should be reclassified under the nearest category before being tracked.
  3. That it is low risk, since it did not merit a category.
  4. That it belongs to a different OWASP project and is out of scope for your team.
Show the answer

Nothing about its severity — the list is ten categories chosen for breadth and testability, and domain-specific logic flaws are exactly what it cannot enumerate.

A06 Insecure Design is the nearest home for logic flaws, but the list was never meant to be the set of things worth fixing.