OWASP Top 10 Report

The OWASP Top 10 Report is a compliance-oriented deliverable that sits alongside the Executive Report and Technical Report. Where those reports organise findings by asset, this report organises the same findings by OWASP Top 10 (2021) category. Its primary purpose is to answer a specific question customers and their auditors frequently need answered: "How do we measure against the OWASP Top 10 standard?"

It is classified TLP:AMBER and should be treated with the same confidentiality as the other reports from the same engagement.

How it differs from the other reports

The OWASP Top 10 Report is a lens, not a new data source. Every finding in it also appears in the Technical Report — the difference is the organisational structure and several unique additions:

• Compliance at a Glance — a summary table mapping findings to each OWASP category with severity counts, making the compliance picture immediately scannable.
• Findings not mapped to any control — a dedicated section surfacing findings that fall outside the OWASP Top 10 framework entirely, ensuring critical issues are never silently dropped because they don't fit a category.
• Appendix A — the only report that explains the full scoring methodology (CVSS, EPSS, CISA KEV, and organisational Risk Rating), making it the reference document for understanding how Ethiack arrives at severity and risk decisions.
• EPSS scores and CVE references are surfaced more prominently than in the other reports, to help teams prioritise by real-world exploitation likelihood rather than theoretical CVSS severity alone.

It omits the full reproduction evidence (raw HTTP requests and responses) that the Technical Report contains — it is a compliance evidence document, not a remediation working document.

Report structure

1. Executive Summary

1.1 Overview follows the same structure as the other reports — a qualitative narrative of the overall security posture framed around OWASP compliance. It explicitly frames adherence to the OWASP Top 10 as an industry-recognised best practice and a fundamental requirement for maintaining a strong security posture and ensuring regulatory compliance, positioning the report as audit evidence.

1.2 Compliance at a Glance is unique to this report. It is a summary table showing which OWASP Top 10 categories had findings and at what severity, alongside which categories were tested and returned clean. The explicit "tested but no findings" statement for categories with no issues is as important as the findings themselves — it gives auditors confirmation that test coverage was complete.

2. Scope Summary

Identical to the other reports: in-scope assets, out-of-scope assets, constraints, coverage ratio, and limitations.

3. Detailed report — findings by OWASP category

This is the structural core that distinguishes this report. Each of the ten OWASP categories gets its own subsection. For categories with findings, each entry shows: vulnerability title and hex ID (linked to the Ethiack platform), affected asset, severity, CWE, CVE reference (where applicable), EPSS score, impact narrative, and suggested mitigations.

For categories with no findings, each section explicitly states that no vulnerabilities were identified — providing the clean coverage attestation needed for audit purposes.

3.11 — Findings not mapped to any control captures findings that do not map cleanly to any OWASP Top 10 category — a known gap in the framework. Rather than force-fitting findings into incorrect categories or silently dropping them, Ethiack surfaces them explicitly as unmapped, ensuring critical issues are never lost because the framework doesn't have a perfect home for them.

4. Final Remarks

Same synthesis as the other reports, but framed around OWASP compliance gaps. Recurring themes are called out as systemic rather than isolated, reinforcing the need for a programme-level response rather than one-off fixes.

Appendices

Appendix A — Severity and Risk Rating Explanations is unique to this report and the primary reference for understanding how Ethiack scores and prioritises findings:

• Severity (finding level) uses CVSS as the baseline (None: 0.0 / Low: 0.1–3.9 / Medium: 4.0–6.9 / High: 7.0–8.9 / Critical: 9.0–10.0), contextualised with two additional signals. EPSS (Exploit Prediction Scoring System) estimates real-world exploitation probability. CISA KEV (Known Exploited Vulnerabilities) cross-references findings against confirmed in-the-wild exploits — any KEV-listed finding is automatically escalated to Critical regardless of its CVSS score.
• Risk Rating (organisational level) is a three-tier aggregate (Low / Medium / High) that weights finding volume, severity distribution, and real-world exploitability signals. This is the single score that answers the board-level question: "how exposed are we?"

Appendix B — Out-of-Scope Assets: The full list of excluded assets for traceability.

Appendix C — Methodology: The full test coverage list tied to OWASP Top 10 and ASVS — the audit trail confirming what was tested.

Value this report delivers

The OWASP Top 10 Report is primarily a compliance and audit instrument. It enables:

• Presenting a structured security posture against a recognised industry standard to auditors, regulators, customers, or insurers
• Identifying which OWASP categories are clean (attestation) versus which have confirmed findings (remediation priority)
• Prioritising remediation using EPSS and CISA KEV rather than CVSS alone — findings rated medium by CVSS may carry a high EPSS score, making them more urgent than their severity label implies
• Understanding Ethiack's full scoring methodology through Appendix A — the only place across all reports where severity and risk rating logic is fully documented
• Surfacing findings that fall outside OWASP's framework, ensuring critical issues are never invisibly dropped because they don't fit a category

When a customer needs to share assessment evidence with a third party — such as a prospective enterprise client performing vendor due diligence, or a compliance auditor — the OWASP Top 10 Report is often the most appropriate deliverable. It speaks a common language without exposing the operational detail of the Technical Report.