01Top 10: Shared Vocabulary, Not a Standard
The OWASP Top 10 is an awareness document: it names the biggest risk categories for web applications, derived from data analyses and community surveys. The current 2025 edition – the eighth overall – draws on data from more than 2.8 million tested applications and considers 589 CWEs; new additions are the categories “Software Supply Chain Failures” (A03) and “Mishandling of Exceptional Conditions” (A10), while “Broken Access Control”, which now also covers SSRF, remains in first place. For development teams, the Top 10 works well as an entry point and as a shared vocabulary with management and auditors – it is not intended as a verifiable requirements list or test catalogue. For that, OWASP itself points to ASVS and WSTG.
02ASVS 5.0: Verifiable Security Requirements
The Application Security Verification Standard (ASVS) translates “secure application” into concrete, verifiable requirements. Version 5.0.0 (released on 30 May 2025) comprises 345 requirements across 17 chapters – from authorization and cryptography to OAuth/OIDC – and three levels: Level 1 as an entry point into using the ASVS, Level 2 as a comprehensive standard security baseline, and Level 3 for applications with high protection needs. Since the requirements are also available in machine-readable form as CSV and JSON, they can be transferred directly into backlogs and definition-of-done criteria – and serve as an objective benchmark in tenders and supplier contracts.
03Cheat Sheets and Developer Guide: Bringing Knowledge into the Team
The Cheat Sheet Series provides compact, implementation-focused guidance on individual topics – from password storage and injection prevention to secrets management – in currently 120 continuously maintained cheat sheets (as of July 2026). Index views link the sheets to ASVS, Top 10 and Proactive Controls, so the right implementation guidance can be found directly for every requirement – ideal for onboarding new developers and as a reference in code reviews. The OWASP Developer Guide, one of the oldest OWASP projects (first published in 2002, currently at version 4.x), deliberately positions itself as a signpost: it does not duplicate content, but serves as an introductory and overview work guiding readers through the OWASP ecosystem.
04WSTG: Deriving Test Cases for Verification
The Web Security Testing Guide (WSTG) is the reference methodology for security testing of web applications. The current stable version 4.2 (December 2020) addresses each test scenario via unique identifiers in the format WSTG-<category>-<number>; version 5.0 is currently being developed publicly on GitHub and should be treated as work in progress. Teams use the WSTG to derive test plans for releases, structure internal security testing and define the scope of external penetration tests in a traceable way – the stable test IDs create a common language between development, testers and service providers.
05Tools: Dependency-Check, Dependency-Track and ZAP
At the tooling level, the ecosystem provides ready-to-use open-source building blocks. Dependency-Check (an OWASP flagship project) is a software composition analysis tool that checks project dependencies against publicly known vulnerabilities from the NVD and integrates into the build via CLI, Maven, Gradle, Jenkins or Azure DevOps. Dependency-Track (also a flagship project) raises this to portfolio level: the platform continuously evaluates CycloneDX SBOMs, supports VEX and makes vulnerability, version and license risks visible across all applications – a building block that carries extra weight given the new Top 10 category “Software Supply Chain Failures”. The DAST scanner ZAP adds automated dynamic testing to the CI pipeline; it has not been an OWASP project since 2023 and has been continued as “ZAP by Checkmarx” since 2024, but remains open source and free of charge.
06Managing Maturity with SAMM – and Tying It All Together
The Software Assurance Maturity Model (SAMM, version 2; current model release v2.2.0 from July 2024) does not measure individual applications but the development process: five business functions (Governance, Design, Implementation, Verification, Operations) with 15 security practices and three maturity levels each – measurable, action-oriented and neutral with regard to both technology and process. A SAMM assessment shows where the organization stands and delivers a prioritized roadmap. This is how the pieces interlock in day-to-day work: requirements flow from the ASVS into the backlog, Cheat Sheets and the Developer Guide support implementation and onboarding, the WSTG structures verification, Dependency-Track, Dependency-Check and ZAP automate checks in the pipeline – and SAMM makes progress measurable and manageable across all teams.
