OWASP Top 10
The list of the most common classes of web application weakness, revised periodically by the foundation.
Teams that need one shared vocabulary for what went wrong.
An open methodAn open standard. There is nothing here to sell you.
OWASP is a volunteer foundation publishing free application security standards and guidance. Nobody licenses it and nobody resells it, ourselves included. We test and build to it.
There is nothing to buy and nothing for us to sell you. It is how the work is done.
What it covers
The parts we actually work to.
6 listed
ASVS (Application Security Verification Standard)
A levelled set of verifiable security requirements, specific enough to test an application against line by line.
Teams that want a standard to build to, not just a list to worry about.
MASVS and the Mobile Application Security Testing Guide
The same approach for mobile, with a testing guide alongside the requirements.
Anyone shipping an Android or iOS application.
OWASP Top 10 for LLM Applications
The equivalent list for applications built on language models — prompt injection, sensitive data disclosure, insecure output handling, excessive agency.
Teams putting a model in front of customers or internal data.
Cheat Sheet Series
Short, practical guidance on doing one thing correctly: session management, password storage, input validation, file upload.
Developers who want the answer rather than a whitepaper.
SAMM (Software Assurance Maturity Model)
A way to measure how an engineering organisation handles security and plan the improvement in steps.
Engineering leaders asked to show a programme, not a one-off test.
What buying through us changes
A partnership is only worth what it changes.
Nothing to buy, and no list to beat
OWASP material is free to download and free to use, and we do not put a margin on a public standard. Where paid testing or scanning tooling is genuinely needed alongside it, we buy that from vendors we do resell — and there the price is better than list.
Named contacts — ours, not a vendor's
There is no company behind OWASP to escalate into; it is volunteers and working groups. What you get instead is the named engineer who tested your application, with their notes, so you can question a finding and get a straight answer.
No credits to apply for
The standard and the guidance cost nothing whether you are two people or two thousand, so there is nothing to award. Where the same project needs paid tooling or cloud, we sponsor those credit applications separately and the award is the vendor's call.
How we help
The work around the product.
- Test applications against the ASVS at a level agreed with you, rather than against a scanner's default profile.
- Map every finding to the Top 10 so developers, auditors and customers are reading the same categories.
- Write the secure-coding standards and review checklists your team will actually use, drawn from the Cheat Sheets.
- Build dependency and configuration checks into your CI pipeline so regressions are caught before release, not at the next test.
- Review model-backed features against the LLM Top 10 — prompt injection, what the model can reach, what it is allowed to do with it.
- Use SAMM to plan the improvement, so the next test is not a rerun of the last one.
Where this is not the answer
OWASP is a method, not a certificate. Nobody is 'OWASP certified' — anyone selling you that is selling something that does not exist, and we are not going to be that firm. The material is free: you can read the Top 10 and the ASVS this afternoon without paying anyone, us included. What we charge for is the testing, the fixing and the engineering, never access to the standard. It also does not cover everything — infrastructure, identity, physical security and staff risk sit outside it, and a regime that demands an audited certificate needs an auditor, not this.
Next step
Buying OWASP? Talk to us first.
Tell us what you are trying to do and we will come back with the sizing, the licensing and the price — from a partner, within two working days.