What does OWASP stand for?
OWASP stands for Open Worldwide Application Security Project. The Open Worldwide Application Security Project (CompTIA's list uses the older name, Open Web Application Security Project). It publishes the OWASP Top 10 and SAMM, and was the original home of ZAP.
OWASP is a non-profit foundation that publishes free, community-written material on software security. Its best-known document is the OWASP Top 10, a periodically updated list of the most critical web application security risks, such as broken access control and injection. Other projects include the Application Security Verification Standard, the Web Security Testing Guide and a separate Top 10 for APIs. Its lists are awareness documents and common reference points, not laws or certifications.
OWASP in practice: an example
A company's secure-coding policy says every web release must be reviewed against the current OWASP Top 10. During a review, a tester finds that changing an ID in the URL shows another customer's order, which falls under broken access control, the first item on the 2021 list.
What OWASP is confused with
OWASP vs NIST: what is the difference?
NIST is a US government agency whose frameworks and publications cover security programmes as a whole. OWASP is a community foundation focused on application security.
OWASP vs CWE: what is the difference?
CWE is MITRE's detailed catalogue of weakness types. The OWASP Top 10 is a short, ranked awareness list, and each of its categories maps to many CWEs. What CWE stands for
Which exams cover OWASP?
OWASP is on the official CompTIA acronym list for one of the four exams covered here.
- CySA+ CS0-004: on the acronym list, not tied to one objective. Listed there as “Open Web Application Security Project”.
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A developer asks where to find a widely recognised list of the most critical web application security risks. What should you point to?
- The OWASP Top 10
- The CVE list
- The IANA port registry
- The Wi-Fi Alliance certification list
Show the answer
A. The OWASP Top 10. The OWASP Top 10 is the standard awareness document for web application risks. CVE lists individual product flaws, not risk categories.
2. A web application lets a signed-in user view another user's records by changing an ID in the address bar. Under which OWASP Top 10 category does this fall?
- Broken access control
- Cryptographic failures
- Security logging and monitoring failures
- Server-side request forgery
Show the answer
A. Broken access control. The user is authenticated but is not authorized for that record, which is a failure of access control.
Sources: OWASP Foundation: About; OWASP Top Ten. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.