Home / Knowledge hub / OWASP mapping
Knowledge hub
OWASP mapping
Tagging each finding with the OWASP risk category it falls under.
What it means
OWASP mapping means labelling each finding with the category it belongs to in an OWASP list, usually the OWASP Top 10 for web applications or the OWASP API Security Top 10. A missing ownership check, for example, goes under Broken Access Control.
The lists are awareness documents, built from data and expert opinion, and not exhaustive standards. Their categories are broad on purpose, which makes them useful for sorting and for talking about risk in plain terms. The categories are revised from time to time, so the version matters when you cite one.
Why it matters
Many customers, auditors and developers know the Top 10 by heart. A finding labelled with its category is understood quickly, and a report organised by category shows at a glance where the weak area is. It is the common language of web security.
It also helps planning. If most findings fall under broken access control, you know where to put design effort. The list is often named in contracts and questionnaires, so a mapping saves you an extra pass of work. It also gives developers a familiar starting point for reading about a type of flaw and how to prevent it.
How it shows up
Each finding gets the category of its main cause, ideally alongside a CWE mapping for detail. Use the list that fits: the Top 10 for web apps, the API Top 10 for APIs, and the LLM Top 10 for language-model features.
Where it misleads: a category is not a severity, and a clean report against the list does not mean the app is secure. The lists are updated from time to time, so state which version you mapped to. Treat the category as a label for the cause, never as the score.
Questions people ask
OWASP mapping, answered
Is the OWASP Top 10 a standard?
No. It is an awareness document that describes the most critical risk categories. OWASP's ASVS is the verification standard.
The Top 10 is a good starting point and a poor checklist.
Does OWASP mapping change a finding's severity?
No. Mapping names the category. Severity depends on how bad this specific flaw is in your system.
A low-risk finding can sit in a high-profile category. Always report both. A finding's category never replaces its rating.
Which OWASP list should we use for an API?
The OWASP API Security Top 10 covers risks specific to APIs, such as broken object-level authorisation. Use it alongside the web Top 10 if the same product has both.
State which version you used.
Should every finding have an OWASP category?
Most do, but some do not fit well, such as a configuration issue with no clear category. Map what fits and leave the rest honestly unmapped.
Forcing a poor fit makes the data less useful.
How does OWASP mapping differ from CWE mapping?
OWASP categories are broad groups of risk, ten in the main list. CWE entries are many and specific.
Using both gives a simple label for summaries and a precise one for developers.
Sources
Where this comes from
Related
Terms that sit next to this one
OWASP Top 10
A widely used list of the ten most critical web application risks.
OWASP API Security Top 10
The OWASP list of the most serious risks specific to APIs.
OWASP ASVS
A detailed checklist of security requirements for web applications.
CWE mapping
Tagging each finding with the weakness type that describes it.
Broken access control
An application failing to enforce its own rules about who may do what.
Which category does it fall under?
Findings from Cyberlop carry OWASP and CWE references next to the proof, so you can sort by category without losing the detail. Severity and confidence stay separate. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.