thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

OWASP Top 10

OWASP's awareness document ranking the ten most critical web application security risk categories, updated every few years.

Definition

The 2021 edition lists Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, and SSRF. The 2025 edition adds Software Supply Chain Failures and Mishandling of Exceptional Conditions, folds SSRF into Broken Access Control and moves Security Misconfiguration to A02. Categories map to groups of CWEs.

Example

PCI DSS assessors often expect secure coding training to cover the OWASP Top 10.

Exam tip

Know which edition a question uses; Broken Access Control is A01 in both 2021 and 2025.

Related terms