OWASP WSTG Report

The OWASP WSTG Report is a compliance-oriented deliverable that maps findings against the OWASP Web Security Testing Guide (WSTG) — a different and more granular standard than the OWASP Top 10. Where the Top 10 categorises vulnerabilities by risk class (e.g., Injection, Broken Access Control), the WSTG organises testing by testing activity (e.g., Authentication Testing, Input Validation Testing, Session Management Testing).

This makes it the right report to use when a customer or auditor needs to demonstrate that a specific set of web security test procedures was executed, not just that certain vulnerability classes were checked.

It is classified TLP:AMBER and should be treated with the same confidentiality as the other reports from the same engagement.

How it differs from the other reports

The WSTG Report has several structural differences that make it distinct from both the Technical Report and the OWASP Top 10 Report:

• Introduction section — the report opens with a formal Introduction before the Executive Summary, covering scope, limitations, timeline, and a point-in-time disclaimer. This mirrors the format expected by auditors using WSTG as a testing standard.
• Strategic Recommendations — the Executive Summary contains a three-horizon remediation roadmap (Immediate, Short-term, Long-term) that is absent from the other reports.
• WSTG category organisation with summary tables — each testing category opens with a summary table before the individual finding details, giving a faster at-a-glance view than the Technical Report's per-asset structure.
• Findings appearing in multiple categories — unlike the other reports, the same finding may be cited under multiple categories. This reflects the multi-dimensional nature of WSTG testing: each category asks different questions about the same vulnerability.
• Appendix B — Methodology table — a full lookup table of WSTG category codes and their descriptions, making this the definitive reference for what each WSTG-* code means in context.

It omits the full reproduction evidence (raw HTTP requests and responses) from the Technical Report — it is a compliance evidence document, not a remediation working document.

Report structure

1. Introduction

Unlike the other reports, the WSTG Report opens with a formal Introduction section.

1.1 Scope restates the in-scope assets and frames the engagement explicitly around the WSTG methodology.

1.2 Limitations documents the nature of the assessment and acknowledges that additional vulnerabilities may exist in untested areas — important context for auditors asking whether coverage was complete.

1.3 Timeline provides the engagement date range.

1.4 Disclaimer states that the report represents a point-in-time evaluation, that the environment may have changed since testing, and that regular reassessments are recommended.

2. Executive Summary

2.1 Objective and Business Context frames the purpose — identifying vulnerabilities that could impact business operations, data confidentiality, and data integrity.

2.2 Assessment Scope confirms the finding totals. Note that informative findings are excluded from the WSTG scope — WSTG tests focus on exploitable weaknesses, not best-practice gaps. The total finding count will therefore be lower than the Technical Report.

2.3 Strategic Recommendations is the most actionable section and is unique to the WSTG format. It structures remediation into three clear horizons:

• Immediate — address critical and high severity findings without delay
• Short-term (1–2 weeks) — remediate remaining high and medium findings, harden configurations, and verify fixes with targeted testing
• Long-term — establish a secure SDLC with regular code reviews, automated security testing, developer security training, formal patch management, and periodic third-party assessments

This three-horizon framing is particularly useful when presenting to a CISO or engineering lead who needs to sequence remediation effort against ongoing delivery work.

3. Scope Summary

Standard content: in-scope assets, out-of-scope assets, constraints, coverage ratio, and limitations.

4. Detailed report — findings by WSTG category

This is the distinctive structural core of the report. Each WSTG category gets its own subsection with a summary table followed by individual finding details. Categories with no findings explicitly state that no vulnerabilities were identified — providing the clean coverage attestation needed for audit purposes.

The finding detail format follows the same structure as the Technical Report: description, steps to reproduce, evidence, impact, and suggested mitigations.

Findings not mapped to any control — a dedicated section captures findings that could not be mapped to any WSTG testing category. The report acknowledges this explicitly as a known limitation of the framework: WSTG is excellent for testing web application security controls but does not cleanly map all vulnerability classes. Customers reading this report should pay particular attention to this section, as it may contain some of the highest-severity findings from the engagement.

5. Final Remarks

Same synthesis as the other reports, positioned within the WSTG framing. Recurring themes are called out as systemic, reinforcing the need for programme-level investment rather than one-off fixes.

Appendices

Appendix A — Severity and Risk Rating Explanations covers CVSS severity ranges, EPSS, and CISA KEV — identical to the same appendix in the OWASP Top 10 Report.

Appendix B — Methodology is unique to this report. It provides a lookup table of all WSTG category codes used in the engagement with their full names and a short description of what each category tests — the most complete testing reference across all reports.

Value this report delivers

The WSTG Report is primarily used when a customer needs to demonstrate systematic security testing coverage against a named, internationally recognised methodology. Specific use cases include:

• Vendor security questionnaires that ask whether WSTG-aligned testing is conducted
• Internal audit requirements for structured methodology evidence
• Procurement processes where buyers require WSTG as a testing standard

The Strategic Recommendations section also makes this a strong document to share with engineering leads who need a phased, time-bounded remediation plan rather than a raw finding list.

When a customer needs to prove how they were tested rather than just what was found, the WSTG Report is the appropriate deliverable.