Be careful.<p>The OWASP Top 10 is a somewhat useful benchmark and an easy way of communicating the general concept of web application security to people; it&#x27;s especially useful when an assessment might involve both web security and other stuff, and you want to be clear that you&#x27;re just poking at the web stuff.<p>Apart from that: OWASP is not a very reliable resource. The project has given some genuinely bad advice over the years. In particular: don&#x27;t rely on any advice they give about cryptography.