How does OWASP rank the top 10 risks?

Question

I was reading articles about OWASP A2 (2017) and the found below comparison chart. One thing I noticed was that "Broken Account and Session Management" has changed place over the years:

• In 2003 and 2004 it was A3.
• In 2007 it was A7.
• In 2010 it was A3.
• In 2013 and 2017 it is A2.

What is the reason for this?

(Original source from which the image was generated is unknown. Google reverse image search https://images.app.goo.gl/haEq2nxGjKYzgWrR9 shows that a more complete image that includes footnotes is at https://goldcrock.wordpress.com/2015/02/ - but it's unclear where that was originally sourced.)

Answer 1

My understanding is that they are rated on the prevalence of that specific risk in the wild.

This is explained in the introduction to OWASP top 10 here

Welcome to the OWASP Top 10...reorders some of the others based on changing prevalence data.

So A1 is more common in the wild than A2 and so on.