The OWASP Top 10, explained simply
The OWASP Top 10 is the reference list of web application risks. Here is what each category means, in plain language, and how we test for it.
The main risk families
- Broken access control: one user reaches another’s data or functions
- Cryptographic failures: sensitive data poorly protected
- Injection: user data interpreted as code (SQL, commands, XSS)
- Insecure design: flaws in the application’s logic itself
- Security misconfiguration: defaults, overly verbose errors
- Vulnerable and outdated components: unpatched libraries
- Authentication failures: passwords, sessions, missing MFA
- Software and data integrity failures: unverified updates or pipelines
- Logging and monitoring failures: attacks go unnoticed
- Server-side request forgery (SSRF): the server calls addresses it shouldn’t
What it means for you
The first category, access control, is the most common finding and one no automated tool catches well: you have to test with several accounts. That’s why our web app tests are always authenticated, with multiple roles.
Note
OWASP updates its list periodically; order and titles may vary between editions. The principles remain.
Take the cybersecurity self-assessment
Frequently asked questions
Does an automated scan cover the Top 10?
Only partly: injection and configuration, yes; access control and business logic, rarely.
Planning web application penetration testing?
Describe your situation in a few lines; an engineer will call you back quickly. The site visit and quote are free.
Request a quote
Free, no obligation. A quick answer from an engineer, in English or French.
- Free site visit and quote
- An engineer, not a salesperson
- 15+ years’ experience, across Quebec
- Hardware stocked on altea.io
Updated 2026-11-05