What is OWASP?

OWASP is run by the security community rather than a vendor, and everything it publishes is free to use. Developers use it to build securely, buyers use it to ask the right questions, and auditors and testers use it as a common reference.

What you're most likely to meet:

• The OWASP Top 10, the ten most critical security risks to web applications. The current edition is 2025.
• The OWASP Top 10 for LLM Applications, the same for anything built on a large language model. The current edition is 2026.
• The Application Security Verification Standard (ASVS), detailed security requirements to build and test against.

OWASP doesn't certify anything, so there's no such thing as an "OWASP certified" or "OWASP compliant" website. What a supplier can show is that a system was built and tested against its guidance, usually backed by an independent penetration test.

We build every system against both Top 10 lists, under our ISO 27001 certified secure development controls. See both lists, and what we do about each risk.