OWASP risks, without the textbook.
Buyers ask whether you test against OWASP. Here are the web, API and mobile risks in plain English, with the three things a pentester tests for in each.
Web Risks (OWASP Top 10)
The ten most critical web application risks in the OWASP Top 10:2025. Select a risk to see what a pentester tests for.
API Risks (OWASP API Top 10)
The risks in the OWASP API Security Top 10:2023, where the API itself, not the screen, is the target.
Mobile Risks (OWASP MASTG)
The OWASP Mobile Top 10:2024 risks, tested manually using the OWASP Mobile Application Security Testing Guide (MASTG).
Common questions
Is OWASP a compliance requirement?
Not by itself, but PCI DSS and many buyers expect applications to be tested against common vulnerability classes such as those in the OWASP lists.
What is the number one OWASP risk?
Broken Access Control leads the OWASP Top 10 (2025) for web applications. In the OWASP API Security Top 10 (2023) the first risk is Broken Object Level Authorization.
What is the OWASP MASTG?
The Mobile Application Security Testing Guide is OWASP’s manual for testing iOS and Android apps, used with the Mobile Top 10 risks and the MASVS requirements.