OWASP Top 10 Coverage
Coverage matrix
The table below maps the 14 Phase-1 tools to the OWASP Top 10 2025. Paladin is not listed here - it is the Phase-2 engine that reasons over all tool output and adds an analysis layer spanning every category (see below).
| # | OWASP Top 10 (2025) | Phase-1 Tools |
|---|---|---|
| A01 | Broken Access Control (incl. SSRF) | Web Scanner, Vuln Scanner, Code Scanner |
| A02 | Security Misconfiguration | Vuln Scanner, Server Audit, Port Scanner, Web Scanner, Enumerator, Net Scanner, WAF Detect |
| A03 | Software Supply Chain Failures | Dep Scanner, Secret Scanner, Code Scanner |
| A04 | Cryptographic Failures | TLS Analyzer, Web Scanner, Vuln Scanner |
| A05 | Injection (incl. XSS) | Web Scanner, Vuln Scanner, Server Audit, Code Scanner |
| A06 | Insecure Design | Code Scanner |
| A07 | Identification & Authentication Failures | Web Scanner, Vuln Scanner, Server Audit |
| A08 | Software & Data Integrity Failures | Dep Scanner, Secret Scanner, Code Scanner |
| A09 | Security Logging & Monitoring Failures | - |
| A10 | Mishandling of Exceptional Conditions | Web Scanner, Vuln Scanner, Code Scanner |
Paladin (Phase 2) - an analysis layer across all categories
Paladin is TurboPentest's Phase-2 engine, not one of the 14 Phase-1 tools. Its specialist agents reason over the combined Phase-1 output, run their own active tests, validate exploits, and chain findings. This adds a reasoning layer that spans the entire Top 10 - and reaches design-level categories that scanners alone cannot cover well:
- A01 / A05 / A10 - agents confirm access-control, injection, and error-handling issues with live proof-of-concepts rather than tool-reported signals
- A06 Insecure Design - surfaced through Paladin's threat modeling and STRIDE analysis
- A09 Security Logging & Monitoring Failures - assessed by Paladin's design-level review
- AI/LLM targets - the AI/LLM Security Analyst specialist maps to the OWASP LLM Top 10 2025, the OWASP AI Testing Guide, and MITRE ATLAS
Notes
- Coverage extends beyond the Top 10: TurboPentest also aligns with the OWASP API Security Top 10 2023 and the OWASP Web Security Testing Guide (WSTG) 4.2.
- White box tools (Code Scanner, Dep Scanner, Secret Scanner) significantly improve coverage for A01, A03, A05, A06, A08, and A10.
- All findings include the mapped OWASP category when applicable.
Tool Overview
All 14 TurboPentest security tools at a glance - 11 black-box scanners plus white-box source tools, each running in its own isolated container.
Network Tools
TurboPentest's network reconnaissance tools for port discovery, service fingerprinting, and TLS analysis of your external attack surface.