The OWASP Top 10 — a security practitioner's map
In 2017, Equifax disclosed a breach that exposed the personal data of 147 million people. The root cause was a known vulnerability in the Apache Struts framework — a library the application depended on — for which a patch had been available for months. The attack mapped directly to what is now A06:2021 — Vulnerable and Outdated Components. Had the development team been using the OWASP Top 10 as a routine checklist, this category would have prompted them to audit their dependencies before attackers did.
This is why the OWASP Top 10 matters. It is not an academic exercise. Every category on the list corresponds to a class of real attacks that have caused measurable harm to real organizations — financial loss, regulatory fines, reputational damage, and in some cases, direct risk to human safety.
Why this list specifically?
The OWASP Top 10 is compiled from vulnerability data contributed by hundreds of security firms, bug bounty programs, and application security testing vendors. It reflects what attackers are actually exploiting in the wild, not what is theoretically possible in a laboratory. This makes it the most broadly recognized baseline in web application security.
Its influence extends well beyond the security team. PCI DSS — the payment card industry's compliance standard — references it directly. Many software development lifecycle (SDLC) frameworks mandate OWASP Top 10 reviews at defined checkpoints. Bug bounty programs use it to scope submissions. When a developer, an auditor, and a penetration tester discuss "A01," they are all speaking the same language.
What you will learn in this lab
By the time you complete this lesson, you will be able to:
- Name all ten OWASP Top 10 2021 categories and explain what each represents.
- Given a real-world attack scenario, identify which category applies and explain why.
- Explain how the list is used as a practical checklist during code reviews, threat modeling, and security assessments.
The mapping exercise in the next step will challenge you to match ten realistic attack scenarios to their correct OWASP category. Work through each one carefully — the distinctions between categories are exactly the knowledge gaps that attackers exploit.