I ask this question because there is a common compliance argument that performing an "OWASP Top 10" scan provides enough coverage to consider it an "in-depth" scan. Is this the case, or are organizations implementing a minimal level of scan coverage?

  • 1
    Does an "OWASP top 10 scan" cover most web vulns? Certainly not. But a manual pentest of the same could be very comprehensive. Jun 9 '20 at 18:19
  • 1
    That's my impression as well, it seems like a naive approach to web application scanning, especially if your penetration tests are infrequent.
    – Scinerio
    Jun 9 '20 at 18:53


"It represents a broad consensus about the most critical security risks to web applications."

So, yes, by definition, the goal of the Top 10 is to describe the "majority of potential web vulnerabilities".

But your next step is not logically supported by that fact.

performing an "OWASP Top 10" scan provides enough coverage to consider it an "in-depth" scan

I can list the top ten most common human diseases, but that does not mean that any given diagnostic scan for those diseases is comprehensive, complete, or accurate.

An "OWASP Top 10 scan" cannot possibly be definitive for all possible instances of those vulnerabilities, and in fact, some items on the Top 10 list cannot be scanned for.

So, no, an "OWASP Top 10 scan" cannot be described as an "in-depth scan". Depth is defined by how the scan is performed, not by the broad categories of vulnerabilities it is inspired to look for.

The OWASP Top 10 is descriptive (backwards-looking), not prescriptive (forwards-looking). From examined web apps, the ten biggest problems found are those ten. That does not mean that there are only ten possible vulnerabilities classifications.

And that does not mean that knowing these ten exist makes it possible to find them in any given web app. When breaches occur, it may be possible to trace things back to these likely vulnerabilities, but that's easier when you have the breach to start from. It gets significantly more complex if you are starting from a well-running app.

However, if you can find them in the web app from a scan or some other automated or simple process, then that's an indication of a significant weakness in the web app since attackers will also use these methods.

An in-depth analysis (not scan) of a web app includes many different approaches and techniques to quickly provide coverage of possible vulnerabilities before release. But remember that attackers have all the time in the world to look for the one thing you couldn't find in time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.