# OWASP Top 10:2025 — ten risks, ten evidence questions

Original SecNet workpaper · 1.0 · 11 October 2026

Complete placeholders for your assessment. The example below is fictional; it is not an executed test or a legal decision.

## Assessment identity

- Record ID: [___]
- Objective and decision question: [___]
- Scope / exclusions: [___]
- Criteria and version: [___]
- Authorization and limits: [___]
- Owner / independent reviewer: [___]
- Period / artifact digest: [___]
- Evidence access / retention: [___]

## Planned procedure

1. Identify the release and business workflows being assessed; record third-party and inherited controls separately.
2. Map each relevant risk to assets and a testable security rule, not simply a checkbox with the category name.
3. Choose synthetic positive and negative cases at the actual server or trust boundary. Obtain authorization before dynamic testing.
4. Validate tool alerts and document exploitability prerequisites, affected build and redacted evidence.
5. Assign remediation to code or platform owners; review shared root causes when several categories point to one architectural defect.
6. Retest with the original failing case plus a permitted neighboring case. Preserve untested coverage and residual risk explicitly.

## Evidence and decision register

| ID | Criterion | Observation | Redacted evidence / origin / time | Conclusion and limitation | Owner / date | Recheck |
|---|---|---|---|---|---|---|
| [___] | [___] | [___] | [___] | [___] | [___] | [___] |

## Topic-specific deliverables

- [ ] Risk-to-control coverage matrix with the OWASP edition.
- [ ] Validated technical findings and release-specific evidence.
- [ ] Remediation/retest register and gaps beyond Top 10.

## Worked fictional decision example

Fictional review: an authorization bug and a missing alert are separate questions. Fixing object ownership does not prove alert routing works. Give each control its own evidence and closure condition; use the cards below to discuss ownership with engineering, platform and response teams. A “Top 10 compliant” claim would overstate what this exercise establishes.

## Closure check

- [ ] Category labels and report edition both say 2025?
- [ ] Every relevant category has a testable rule and evidence?
- [ ] Coverage beyond awareness categories considered?

## Official references · checked: 2026-10-11

- [OWASP Top 10:2025](https://top10.owasp.org/2025/)
- [OWASP ASVS](https://owasp.org/projects/asvs)
- [Semgrep documentation](https://docs.semgrep.dev/)
- [Trivy documentation](https://trivy.dev/latest/docs/)
- [ZAP documentation](https://www.zaproxy.org/docs/)