Use the OWASP Top 10 to raise awareness, the Application Security Verification Standard (ASVS) to set and verify requirements, and the Web Security Testing Guide (WSTG) to learn how to test. They answer different questions, so many teams use all three at different times.
One line each
Top 10. OWASP calls it a standard awareness document for developers and web application security. The latest edition is the 2025 version, with 2021 and 2017 before it.
ASVS. A basis for testing the technical security controls of web applications and a list of requirements for developers building secure software. The page lists 5.0.0 as the latest stable release.
WSTG. A testing resource for web application developers and security professionals. The project page lists v4.2 as the latest stable version, with 5.0 in development.
Decision table
| Your question | Start with |
|---|---|
| What risks should our developers know about? | Top 10 |
| What exactly must our app do to be secure? | ASVS |
| How do we check that it does? | ASVS for requirements, WSTG for test methods |
| What should a pen tester cover? | WSTG, scoped with ASVS |
| How do we train new engineers? | Top 10, then ASVS |
Using them together
- Teach the Top 10 so everyone shares vocabulary.
- Choose an ASVS level that matches the app's risk and write the chosen requirements into your backlog or acceptance criteria. The ASVS page itself does not describe levels, so read the project documentation for what each level asks.
- Use the WSTG to design test cases for requirements that tools cannot check.
- Track results per requirement, so an auditor or customer can see coverage.
Common mistakes
- Treating the Top 10 as a checklist. It is a ranked awareness list, not a complete requirement set.
- Aiming for the highest ASVS level everywhere. Match it to risk.
- Skipping the API list. OWASP's API Security Top 10 2023 says teams with an app backed by an API should review both the app list and the API list.
Common mistakes
People also confuse awareness with assurance. Knowing the Top 10 does not show that an application meets any requirement. If a customer asks whether you follow ASVS, state which version and level you used and what you checked, and be ready to show the evidence. Keep your references current: the project pages above show the latest releases at the time of writing, and newer editions may appear, so check before you cite a version in a contract or questionnaire.
Quick check
Is ASVS a certification?
No. It is a standard you test against. Any claim of conformance should state the version, level and who verified it.
Do automated scanners cover ASVS?
Partly. Many requirements need manual review or design analysis.
Where Safeguard fits
Safeguard provides compliance and evidence automation, SBOM and dependency scanning and policy gates. See your dependency side with the free scan.
Sources
Last reviewed: 19 October 2026.
