OWASP Top 10 or OWASP ASVS: what a scanner checks and what only a requirements catalogue covers
Two OWASP documents with two very different jobs. The Top 10 ranks risk classes by how often they cause incidents; the ASVS lists verifiable requirements an application must meet. Why a scanner can orient on the first but never substitute for the second, and where CAVRIX draws that line.
Two documents that keep getting confused
Same publisher, same word in the title, same habit of turning up in vendor slide decks as a stamp of quality. Beyond that the two have little in common. The Top 10 is an awareness ranking, refreshed every few years from incident data, of the ten categories most likely to hurt an application in practice. The 2025 list opens with access-control failures, followed by misconfigured security settings, and has a newcomer in third place: weaknesses that arrive through the components an application is built from.
The Application Security Verification Standard, ASVS for short, is a different animal. It is a catalogue of concrete requirements for an application, organised by topic and graded into verification levels, from a baseline up to a level meant for applications with high protection needs. The ASVS does not answer what goes wrong most often. It answers what an application must demonstrably satisfy.
What a scanner can do with the Top 10
A scanner finds what has a pattern: hardcoded credentials, libraries with known flaws, unvalidated input, dangerous system calls, missing access checks in recognisable places. For deciding which finding gets handled first, the Top 10 ordering is a usable rule. Our code scan therefore orients on exactly that catalogue: a finding that falls into the broken-access-control class is queued ahead of one from a lower-ranked class, unless the real risk in the context of the codebase says otherwise.
What the scanner does not do is cover the Top 10. A ranking cannot be covered, only used as a yardstick. Anyone promising you a tick next to each of the ten classes is selling a list as if it were an audit.
What only verification against the ASVS achieves
ASVS verification runs the other way round. The tool does not hunt for patterns in the code; a person takes the requirements one by one and checks whether the application meets them, looking at architecture, configuration, processes and, yes, code as well. Many requirements concern things that never appear in source text: how sessions are managed, whether permissions match the business model, how keys are stored, which decisions were made at design time.
That is why no scanner can deliver ASVS verification, ours included. A business-logic requirement has no fixed pattern, and a statement about design cannot be derived from lines of code. Whoever needs an ASVS statement, for instance because a large customer demands one, needs an assessment by people with the catalogue in hand.
Where CAVRIX draws the line
We put it as plainly as our code security and compliance page does: the Top 10 is our reference frame for assessing findings, nothing more. We do not offer ASVS verification and make no statement about ASVS levels. What we deliver is a continuous scan on every commit, a human assessment of every finding and dated documentation of the fix.
If you need both, combine them. The scan keeps the known classes of flaw out of the code continuously. Verification against the ASVS or a penetration test periodically checks what has no pattern. Which test is right for that and what it has to guarantee is on our penetration testing page.
A rule of thumb for proposals
When a proposal says OWASP with nothing after it, ask: Top 10 or ASVS, and in what role. If the answer is that the scanner orients on the Top 10 and prioritises accordingly, that is honest and useful. If the answer is that the scanner checks the application against the ASVS, ask who verifies the requirements that have no pattern. If no answer comes, you know enough.
Frequently Asked Questions
Does the CAVRIX scan cover the OWASP Top 10?
It uses the Top 10 as its order of assessment and finds the classes of flaw within it that have a pattern. A ranking cannot be covered. We promise no tick next to each class, only dated findings and fixes.
Does CAVRIX offer ASVS verification?
No. The ASVS is verified requirement by requirement by people, and many of its requirements concern design and process rather than code. That is a different service from a continuous scan, and we do not claim it.
Is the scan enough when a customer asks about OWASP?
If the customer wants to know whether the most common risk classes are checked and fixed continuously, yes, with dates. If they demand a statement about ASVS levels, it takes human verification, and we say so in the conversation before a proposal is written.