OWASP Top 10:2025 and ASVS Level 1 as a Pen Test Checklist

The OWASP Top 10:2025 is the eighth edition of the list and was built from data covering more than 2.8 million applications and about 175,000 CVE records mapped to CWEs. The Application Security Verification Standard (ASVS) 5.0.0 was released in 2025. Customers increasingly write one or both into security addenda: "tested against OWASP Top 10", "verified to ASVS Level 1".

Those phrases are cheap to write and vague to deliver. This post turns them into something you can put in a statement of work, with counts we computed from the published ASVS CSV on 18 October 2026.

What's affected

Founders and engineering leads who must agree a test standard with a tester or a customer. The two documents do different jobs.

The Top 10 is an awareness list of risk categories. The 2025 edition, in order: Broken Access Control (now including SSRF), Security Misconfiguration, Software Supply Chain Failures, Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software or Data Integrity Failures, Security Logging and Alerting Failures, and Mishandling of Exceptional Conditions. Software Supply Chain Failures and Mishandling of Exceptional Conditions are new.

The ASVS is a testable standard. Each requirement is written so that verification ends in pass or fail. It has three levels. Level 1 is the minimum starting point, and ASVS itself says it is not necessarily testable by an external tester without access to documentation or code, so plan to give the tester documentation and accounts.

How to check if you're exposed

Count what Level 1 really asks. We downloaded the ASVS 5.0.0 CSV from the project's latest release and counted the L column, which gives the level at which each requirement first applies.

curl -sL -o asvs.csv \
  https://github.com/OWASP/ASVS/releases/download/latest/OWASP_Application_Security_Verification_Standard_5.0.0_en.csv
python3 -c "
import csv, collections
r = list(csv.DictReader(open('asvs.csv', encoding='utf-8-sig')))
print(len(r), collections.Counter(x['L'] for x in r))
"

Result on 18 October 2026: 345 requirements. 70 are Level 1, 183 are Level 2 and 92 are Level 3. That is 20%, 53% and 27%. ASVS says Level 2 compliance means meeting all Level 1 and Level 2 requirements, so 253 of 345, roughly 73%. The project's own text says around 20%, 50% and 30%, and our counts agree within a few points. The latest release is a rolling build, so rerun the count if you need the current number.

Level 1 requirements by chapter:

Two Level 1 requirements deserve a highlight for any multi-tenant product: V8.2.1 (function level access restricted to consumers with explicit permissions) and V8.2.2 (data specific access restricted to consumers with explicit permissions to specific data items). Those are the two halves of the access control tests that most often produce critical findings. Supply chain shows up at Level 1 too: V15.2.1 says the application only contains components that have not breached the documented update and remediation time frames.

What to do now

1. Pick the level on purpose. ASVS suggests an early stage company handling limited sensitive data may reasonably target Level 1 first. Say so in the scope.
2. Write the standard into the statement of work. "Testing will cover OWASP Top 10:2025 categories and ASVS 5.0.0 Level 1 requirements applicable to the in scope applications. Not applicable requirements will be listed with a reason."
3. Ask for a coverage matrix. One row per Level 1 requirement with pass, fail or not applicable. This is what turns "tested against ASVS" into something a reviewer can check.
4. Map Top 10 to chapters yourself. Our own rough mapping for planning, not an official one: Broken Access Control to V8 and V4, Security Misconfiguration to V13, Supply Chain to V15, Cryptographic Failures to V11 and V12, Injection to V1, Insecure Design to V2 and V15, Authentication Failures to V6, V7, V9 and V10, Logging to V16, Exceptional Conditions to V16 and V2.
5. Use the testing guide for method. ASVS says verifiers who want to know how to test a requirement should look at the OWASP Web Security Testing Guide, whose current stable version is 4.2 and which has categories from information gathering to business logic and API testing.

How to avoid this trap

• Do not accept "tested against OWASP Top 10" as a scope. It is a list of categories, not a pass or fail checklist.
• Do not claim ASVS compliance unless a matrix backs it. A tester reviewing three chapters has not verified Level 1.
• Remember documentation requirements. ASVS includes requirements that your security decisions are documented, such as validation rules and authorization rules, and verifying the document and verifying the implementation are separate checks.

Why it matters

A named standard gives both sides a finish line. Without one, a test ends when the budget does. With Level 1 as the agreed standard, you can say precisely what was checked and what was not, and a customer can compare your answer with their own expectations.

It also helps your engineers. Seventy requirements is a list a small team can read in an afternoon and design against, which is a far better use of the ASVS than treating it as a compliance badge.

Try it yourself

Download the CSV with the commands above and filter Level 1 requirements for the chapters that apply to your product. Tick off the ones you can already demonstrate. The remainder is your pre test to do list.

Quick check

Sources

• OWASP Top 10:2025 introduction
• OWASP ASVS repository and 5.0.0 release files
• ASVS 5.0 chapter "What is the ASVS?"
• OWASP Web Security Testing Guide