What is absent from the data is not absent from reality
Some categories are hard to test at scale, so they are underrepresented in the contributed data regardless of how common they are. A09 has few CVEs and is voted in by survey; A03 has the fewest occurrences of any category while carrying the highest average exploit and impact scores.
Why it is like this
Scan data measures what tools can find. A weakness nobody has built a reliable test for produces no findings, which looks identical to a weakness that is not there.
Not to be confused with
A reason to distrust the list. It is a reason to distrust your own scan results in the same way — and the survey mechanism exists precisely because the project does not trust its data alone.
In practice
A03 is the sharpest illustration: fewest occurrences in the data, highest exploit and impact when it does appear, and overwhelmingly voted the top concern by practitioners.
Source: OWASP Top 10:2025 — A03 and A09 background notes. Read on .
The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.
Predict Check yourself
A category shows almost no findings across your estate. What are the two possible explanations the Top 10's methodology warns about?
Show the answer
Either the weakness is genuinely rare in your estate, or nobody has a reliable way to test for it at scale — and the data cannot distinguish them.
This ambiguity is the stated reason the list is data-informed rather than data-driven, and it applies to your own dashboards too.