This one is for anyone who relies on the OWASP Top 10 in contracts, procurement questionnaires and assurance reports. I wanted to know what an outsider can actually verify about the 2025 edition's published method and data. I'm not testing whether using the list makes software safer, and I'm not arguing the list is worthless.
The data half holds up. OWASP's scoring formula, published in a slide deck, reproduces its data ranking for all 12 candidate categories from the figures on each category page, and the disputed fourth place for Cryptographic Failures follows from that method. The editorial half doesn't. OWASP says eight categories come from data and two from a survey, but the published ranks and survey results don't produce the final ten under any rule OWASP has written down: the eighth-ranked category was left out and three lower-ranked ones included.
The surrounding numbers don't settle either. The 2025 test data aren't published at all. The number of weaknesses analysed is 589 in one OWASP document and 686 in another, and weaknesses mapped is either 248 or 249 depending on whether you count one added on release day. Three accepted corrections were later undone. Secondary reporting is mostly faithful, though a few articles add errors of their own, like giving the survey result to the wrong category or inventing reasons for the SSRF change.
So you can check the data half of the method and you can't check the editorial half, which is where the order actually comes from. I'd rely on the categories and their mapped weaknesses rather than the ranking, name the revision of the category pages you're relying on, and map SSRF explicitly to A01's CWE-918, which carries no SSRF guidance on the page. The list is still worth using for awareness and for structuring standards.