Flagship Projects: Top 10 "The making of the OWASP Top 10 and beyond"
summary
Explains how the OWASP Top 10 2021 is derived from the largest dataset yet, combining raw incidence rate with a new coverage factor, CVSS exploit/impact subscores pulled via OWASP dependency-check and the NVD, and a weighted formula that also counts occurrences. Notes concrete numbers: about 400 CWEs contributed and ~75% tested by three or fewer orgs, SSRF added despite low measured incidence, and examples where high raw incidence collapses once coverage is considered.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:41Core Principles
- 6:05Start with the Data
- 8:38It can be a little messy
- 14:10Managing Likelihood
- 15:50Need More Data
- 19:43CVSS Scoring
- 21:44Data Porridge
- 22:10(Not so) Secret Formula
