Training Paths
Structured learning paths built from official OWASP projects, guides, and tools. Pick a path, follow the resources, and level up.
[ browse all OWASP projects ↗ ]New to AppSec?
Start your security journey from zero
No prior security experience needed. Learn core web vulnerabilities hands-on using OWASP's beginner-friendly tools and the canonical Top 10 awareness list.
Developer Training
Security skills built for software engineers
Structured lessons for developers to learn secure coding. Covers injection, auth flaws, misconfigurations, and more through guided exercises and the SKF knowledge framework.
Securing APIs
From API Top 10 to runtime protection
Deep-dive into API-specific attack vectors. Covers authentication flaws, excessive data exposure, broken object-level authorization, and how to test and remediate each.
Mobile App Security
iOS & Android security testing end-to-end
The complete OWASP mobile security curriculum: risks, testing methodology, and automated analysis. Covers both iOS and Android platforms with the MASTG and MobSF.
Build an AppSec Program
Mature your organization's security posture
Learn how to design, measure, and scale an AppSec program using OWASP SAMM's maturity model and ASVS as a verification standard. Ideal for security leads and architects.
Supply Chain Security
Secure your dependencies and CI/CD pipelines
Address risks in open-source dependencies, build pipelines, and software bills of materials. Uses OWASP's CI/CD Top 10 and Dependency-Check as the core tools.
Penetration Testing
Structured web app testing from recon to report
Follow the WSTG methodology across all 12 testing categories, automate discovery with ZAP and Amass, and learn to document findings professionally.
Cloud & Container Security
Secure modern infrastructure from IaC to runtime
Covers OWASP's Cloud-Native Top 10, Docker and Kubernetes security cheat sheets, and threat modeling for cloud workloads.
LLM & AI Security
Secure AI-powered applications and LLM integrations
The newest OWASP frontier. Learn the 10 critical risks in LLM applications prompt injection, data poisoning, insecure output handling and how to mitigate them.
Threat Modeling
Design-time security analysis for any system
Learn structured threat modeling with OWASP Threat Dragon, pytm, and the dedicated cheat sheet. Identify, rate, and track threats before writing a line of code.