OWASP

OWASP is a nonprofit organization dealing with the security of software. The name stands for “Open Worldwide Application Security Project.” The organization does not sell products. It gathers knowledge about how attackers break into programs and puts this knowledge online for free. In principle, anyone who wants to contribute can take part: professionals from companies, researchers, volunteers. The best known result is a list called the OWASP Top 10. It lists the ten types of flaws that occur most frequently and most dangerously in programs on the internet.

Why a list of ten flaws shapes half the industry

Security vulnerabilities are no accident. The same mistakes have kept reappearing for decades, in ever new programs. OWASP turns this into a manageable ranking. Instead of a thousand possible problems, a development team first has to work through ten points. That lowers the barrier enormously.

Because the list is free and vendor-independent, it has established itself as a common language. Clients write into contracts that software must be tested against the OWASP Top 10. Auditing bodies and authorities refer to it. Payment service providers also demand corresponding proof from online shops.

For investors this is relevant because security incidents cost money. A data leak can affect the customer data of millions of people. What follows are fines, lawsuits, and a drop in share price. Companies that demonstrably comply with OWASP standards are therefore considered a lower risk by insurers and auditors.

From vulnerability collection to testing tool

The Top 10 does not come out of thin air. OWASP evaluates data from hundreds of thousands of real applications. Added to this is a survey among professionals about which threats they currently see emerging. From both of these, a new version of the list emerges every few years. One example of a typical entry is the so-called injection: an attacker types not a search term into a search field, but a command that the underlying database executes.

Alongside the list there are concrete tools. The ZAP scanner, for instance, automatically calls up a website with thousands of deliberately strange inputs. If the site reacts incorrectly, it flags a suspicion. Many companies run such tests automatically with every code change.

A common misconception: OWASP is not a law and not a certification body. Nobody is audited or penalized by OWASP. It is a recommendation that is so widespread it feels like a standard. And the Top 10 is deliberately incomplete. Anyone who merely checks it off has a basic level of security, but not secure software.

OWASP in AI products and in the news

Since 2023 there has been a dedicated list for applications with language models, i.e. programs like ChatGPT. At the very top is prompt injection. Here, someone hides an instruction in a text that the AI later reads, for example on a website or in an email. The AI mistakes this hidden instruction for a task from the user and follows it. This can be used to extract data or bypass security rules.

In reports about hacker attacks, the name often comes up indirectly. When there is talk of an “SQL injection” or “broken access control,” the term usually comes from OWASP vocabulary. Job postings for developers also regularly cite the Top 10 as expected basic knowledge.

Anyone who codes themselves can download the materials for free. They contain, for each vulnerability, an explanation, an example, and a suggested fix. This makes OWASP one of the few areas of expertise where you can stay up to date with the industry at no cost and without registration.