The OWASP Top Ten 2021 and ZAP | Jim Manico | ZAPCon 2022

## OWASP Top 10 as a Teaching Framework

Jim Manico's ZAPCon 2022 keynote walks the OWASP Top Ten 2021 at speed, linking each category to practical secure-development guidance and showing where OWASP ZAP helps automate discovery.

## Access Control and ZAP

For broken access control—the #1 risk—Manico stresses that scanners cannot know your authorization policy. ZAP's access-control testing add-on lets teams encode application-specific rules so automated tests reflect real business logic, not generic guesses.

## Injection Still Dominates

Despite decades of awareness, injection (including XSS merged into the category) remains pervasive. Manico reminds developers that validation alone cannot fix SQL injection; parameterized queries and safe APIs are the durable fix, not regex filters on exotic inputs.

## Resources and Mindset

He points attendees to OWASP cheat sheets, NIST SP 800-162 for attribute-based access control, and ASVS requirements. The through-line: combine ZAP automation with human policy knowledge to close gaps that turnkey scans alone will always miss.