The previous lesson gave you the CIA triad and a shared security vocabulary. This lesson gives you the map that organizes every vulnerability, technique, and tool in the course: the OWASP Top 10.
The OWASP Top 10 is a periodically updated, community-driven awareness document that ranks the ten most impactful categories of web application security risk. Its job is to tell a team with limited time where to look first — and to give you a shared language with every other security professional you will work with.
In this lesson you will:
- Learn how the list is compiled — from contributed incidence data and a practitioner survey, not from opinion alone.
- Learn to think about risk as likelihood times impact, which is what drives the ordering.
- Learn to keep three constantly-confused terms straight: a weakness class (CWE), a cataloged vulnerability (CVE), and the specific instance in front of you.
This is a map lesson, not an exploitation walkthrough. The vocabulary and mental model you build here will let you place every new vulnerability you encounter onto the map as you learn it.
Estimated time: ten minutes.
When you are ready, send the Continue signal.