OWASP Top Ten

The OWASP Top Ten is a periodically updated list of the most critical categories of web application security risk, published by a non-profit foundation. It is the closest thing the industry has to an agreed baseline.

Its usefulness is as a shared checklist rather than a syllabus. Broken access control, injection, insecure configuration and vulnerable dependencies appear on it because they are what actually goes wrong, repeatedly, in ordinary applications built by competent people.

It is reasonable to ask a supplier how their process addresses it, and reasonable for them to have an answer. Passing it is not a certification and does not make a system secure — but a team unfamiliar with the list is unlikely to have defended against the things on it.