What ASVS verifies, and what it skips
The application-security standard covers a narrow slice of weaknesses, and covers it more completely than any control catalog we map. Narrow and deep, not broad. Last updated: 2026-08-22
OWASP ASVS is the application-security verification standard, 345 requirements for building and testing secure software. Map it against the ten weakness families and its shape is a specialist's, not a generalist's. It reaches the fewest weaknesses of any framework we map, 203, well under a third of what NIST 800-53 touches. But where it reaches, it covers more completely than any control catalog: 41% of its weakness coverage is full strength, the highest on the map. Narrow and deep.
| CWE weakness family | ASVS strength | weaknesses mapped |
|---|---|---|
| Improper Control of a Resource | 0.74 | 65 |
| Improper Neutralization (injection) | 0.85 | 41 |
| Improper Access Control | 0.80 | 38 |
| Protection Mechanism Failure | 0.86 | 27 |
| Improper Adherence to Coding Standards | 0.65 | 16 |
| Incorrect Comparison | 0.96 | 5 |
| Insufficient Control Flow Management | 0.74 | 4 |
| Improper Interaction Between Components | 0.93 | 3 |
| Improper Check of Exceptional Conditions | 0.87 | 3 |
| Incorrect Calculation | 0.35 | 1 |
Strength is our own direct ASVS-to-CWE mapping, graded for how completely ASVS addresses each weakness. The count is how many weaknesses we map ASVS to in the family: a high strength over three weaknesses means "covers those three well," not "covers the family."
Narrow scope, deep where it lands
ASVS was built to verify the web-application attack surface: input and output handling, authentication, authorization. On those families it is strong, and specific enough that many of its mappings are full strength rather than partial. That is the opposite shape from a broad catalog like ISO, which reaches wide and shallow. ASVS reaches narrow and deep.
Two cautions on the per-family numbers. First, some families rest on very few mapped weaknesses. ASVS's coverage of exceptional conditions is graded on three; incorrect calculation on a single one. A high strength over three weaknesses is real but narrow, which is why the table shows the count next to the strength. Second, ASVS barely touches arithmetic correctness, one mapped weakness, the same blind spot every framework has. NIST 800-53 reaches the same family at 0.35. Calculation and control-flow correctness are a code-review, testing, and typed-language problem, not a checklist problem.
The practical read: an ASVS pass is strong evidence about the classes it verifies deeply, and thin evidence about the families it maps sparsely. Read the pass for what it is, a deep check on a specific slice, not a broad one, and pair it with review and testing for the rest.