Is it time to rethink the OWASP Top 10? | Computer Weekly

▤ Summary

This article questions whether the OWASP Top 10 still drives meaningful security improvement in modern software development. It argues that developers often lack business context, security training is weakening, and the list is not actionable enough to change behavior. It also says the framework is too web-focused for today’s broader application landscape, where APIs, mobile, cloud-native, and embedded systems create additional risk. The piece points to tighter regulation such as DORA and the CRA as evidence that security is shifting from guidance to enforcement. It recommends pairing OWASP with broader standards, integrating security into CI/CD, and making accountability and training part of normal delivery.

▦ Linked Companies