OWASP Foundation Courses

Changed Responsibilities in Modern Development Practices

Learn how to shift security left by aligning developer responsibilities and tools with agile, CI/CD, and DevOps practices.

• YouTube
• 26 minutes
• Self-Paced
• Free Video

Analyzing Google's SLSA Framework for Securing Software Supply Chains

A breakdown of Google’s SLSA levels, the source, build, and provenance controls they recommend, and software supply-chain security areas the framework leaves uncovered.

• YouTube
• 20 minutes
• Self-Paced
• Free Video

OWASP Software Assurance Maturity Model - SAMM

A presentation of OWASP’s Software Assurance Maturity Model (SAMM), a flagship project focused on software assurance.

• YouTube
• 28 minutes
• Self-Paced
• Free Video

OWASP Top 10 - Introduction to Web Application Security Risks

An introduction to the OWASP Top 10 flagship project.

• YouTube
• 29 minutes
• Self-Paced
• Free Video

Application Security Verification Standard - OWASP Flagship Project

An overview of the ASVS project’s history, releases, mappings, and leadership.

• YouTube
• 24 minutes
• Self-Paced
• Free Video

OWASP Top 10 - The Making of the OWASP Top 10 and Beyond

A look at how the OWASP Top 10 is built from vulnerability data, likelihood estimates, and CVSS scoring.

• YouTube
• 26 minutes
• Self-Paced
• Free Video

OWASP Dependency Track - Software Composition Analysis and Vulnerability Management

A walkthrough of Dependency-Track shows how SBOMs, component inventories, dependency graphs, and policy checks support software supply chain oversight.

• YouTube
• 25 minutes
• Self-Paced
• Free Video

OWASP CSRFGuard: Understanding and Preventing Cross-Site Request Forgery

Explore CSRF attacks and defenses through OWASP CSRFGuard, from browser security policies and real-world payloads to prevention and automated detection.

• YouTube
• 35 minutes
• Self-Paced
• Free Video

Stop the Looters: Method to Detect Digital Skimming Attacks

Learn a method for auditing JavaScript to detect and deter digital skimmers on websites.

• YouTube
• 28 minutes
• Self-Paced
• Free Video

OWASP Application Gateway: Introduction and Usage for Secure Web Applications

See how the OWASP Application Gateway uses reverse proxying and OAuth2 sessions to secure web apps, with a technical look at its design and customization.

• YouTube
• 24 minutes
• Self-Paced
• Free Video

Connecting the Dots: How Threat Intelligence Protects Applications

Learn how threat intelligence connects indicators of compromise and threat actor tactics to help protect applications.

• YouTube
• 27 minutes
• Self-Paced
• Free Video

Securing the Future: Challenges and Innovations in Application Security

Swathi Joshi delivers a keynote at the 2022 Global AppSec San Francisco conference.

• YouTube
• 52 minutes
• Self-Paced
• Free Video

Application Security Best Practices - 2022 Global AppSec Keynote

Jim Manico delivers a keynote at Global AppSec San Francisco 2022.

• YouTube
• 1 hour 4 minutes
• Self-Paced
• Free Video

Cybersecurity Trends and Challenges - 2022 Global AppSec Keynote

Simon Bennetts delivers a keynote at the 2022 Global AppSec San Francisco conference.

• YouTube
• 1 hour 2 minutes
• Self-Paced
• Free Video

Squeezing the Last Drop Out of OWASP Juice Shop

A focused talk on drawing out the full potential of OWASP Juice Shop.

• YouTube
• 58 minutes
• Self-Paced
• Free Video