The OWASP Top 10 is a prioritized list of the ten most critical security risk categories facing web applications, published and periodically refreshed by the Open Worldwide Application Security Project (OWASP) — a nonprofit best known for producing free, community-driven application security standards. It's built from real-world vulnerability data contributed by security firms and bug bounty programs, ranked by prevalence, exploitability, and impact, and it exists to answer one question for a busy team: out of everything that could go wrong in a web application, what actually goes wrong most often, and in what order should you care?
Quick definition: The OWASP Top 10 is a ranked list of ten web application risk categories, currently in its 2021 edition, each identified by an ID like A01 or A03 and covering a class of vulnerability rather than a single named bug — Broken Access Control, Injection, Cryptographic Failures, and so on.
The current OWASP Top 10 (2021 edition)
OWASP refreshes the list roughly every three to four years as the underlying vulnerability data shifts. The 2021 edition is the current published version:
| ID | Category | What it covers |
|---|---|---|
| A01 | Broken Access Control | Users acting outside their intended permissions — viewing or modifying data they shouldn't reach |
| A02 | Cryptographic Failures | Weak, missing, or misused encryption exposing sensitive data in transit or at rest |
| A03 | Injection | Untrusted input interpreted as code or commands — SQL, OS command, LDAP, and similar injection classes |
| A04 | Insecure Design | Missing or ineffective security controls baked in at the architecture/design stage, not just a coding bug |
| A05 | Security Misconfiguration | Insecure defaults, incomplete configs, open cloud storage, verbose error messages, unnecessary features left enabled |
| A06 | Vulnerable and Outdated Components | Using libraries, frameworks, or dependencies with known vulnerabilities or that are no longer supported |
| A07 | Identification and Authentication Failures | Weak login flows, session handling, and credential management that let attackers assume other users' identities |
| A08 | Software and Data Integrity Failures | Code and infrastructure that don't verify integrity — insecure CI/CD pipelines, unsigned updates, unsafe deserialization |
| A09 | Security Logging and Monitoring Failures | Insufficient logging, alerting, and monitoring that let breaches go undetected long enough to do real damage |
| A10 | Server-Side Request Forgery (SSRF) | An application fetching a remote resource without validating the destination, letting an attacker redirect the request |
Note that OWASP also publishes narrower, adjacent "Top 10" lists for specific technology areas — the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications among them — which cover risk categories specific to AI systems rather than general web applications. Those are worth knowing about if you're threat modeling AI agents or LLM-integrated features, but they're separate lists with their own IDs and cadence; this post covers the original, general-purpose web application list.
Why a prioritized risk list matters for threat modeling, not just pentesting
The OWASP Top 10 is best known as a pentest and code-review checklist, but that undersells it for threat modeling. A pentest happens after something is built, against a live target, and finds what's actually exploitable. Threat modeling happens earlier — at design time, against a data flow diagram or architecture, before a line of code proves anything either way. What the OWASP Top 10 gives a threat modeler is a pre-vetted, prevalence-ranked checklist of risk categories to actively ask about for every component: does this data store enforce access control the way A01 assumes it should? Does this integration validate the URLs it fetches, given A10? It turns "what could go wrong here" from an open-ended brainstorm into a structured pass through ten categories that are empirically the ones most likely to matter.
OWASP Top 10 vs. STRIDE
These get used together constantly, and it helps to be precise about what each one actually is. STRIDE is a threat-elicitation mnemonic — six threat categories (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) that you apply systematically to each element of a DFD, regardless of how common or rare the resulting threat turns out to be in practice. The OWASP Top 10 is a prevalence-ranked list of specific web application risk categories, built from observed real-world data, and scoped to web applications rather than general system architecture.
In practice: STRIDE tells you where to look — walk every process, data store, and data flow, ask all six questions. OWASP Top 10 tells you what's statistically likely to be there once you're looking at a web-facing component. A Tampering threat against an API endpoint (STRIDE) might turn out to be, concretely, a Broken Access Control issue (OWASP A01) or an Injection issue (OWASP A03) — STRIDE finds the threat category, OWASP names the specific, well-documented risk pattern it probably is.
OWASP Top 10 vs. CAPEC
The other frequent point of confusion is with CAPEC, MITRE's much larger catalog of attack patterns. The relationship is scale and ranking, not overlap: CAPEC documents hundreds of specific attack mechanisms in exhaustive detail, unranked and not limited to web applications, while the OWASP Top 10 is a short, prioritized "start here" list of ten risk categories specific to web apps. Most OWASP Top 10 categories map down to a cluster of CAPEC patterns underneath — A03 (Injection), for instance, covers CAPEC-66 (SQL Injection), CAPEC-108 (Command Line Execution through SQL Injection), and several others. Reach for the OWASP Top 10 when you want the ten categories that matter most, in order; reach for CAPEC when you already know the category and need the specific, citable mechanism to name in an attack tree leaf.
Using the OWASP Top 10 in a threat modeling workflow
- As a design-review checklist — before implementation starts, walk each Top 10 category against the architecture and ask whether the current design addresses it, the same way you'd walk STRIDE against a DFD.
- As a tag on individual threats — attaching an OWASP category ID to a threat or attack tree leaf gives it a shared, external reference point that survives past whoever wrote the original description.
- As a prioritization signal — when a backlog of threats is too long to fix at once, threats mapping to Top 10 categories (especially A01–A03, consistently the most prevalent) are a reasonable place to bias effort first.
- As shared vocabulary with auditors and pentesters — because it's the most widely recognized appsec list outside the threat modeling world, tagging threats against it makes a threat model legible to security reviewers who may not know STRIDE or CAPEC at all.