---
title: "OWASP Top 10 Coverage"
description: "How TurboPentest's 14 Phase-1 security tools map to the OWASP Top 10 2025, with Paladin (Phase 2) adding an analysis layer that spans every category."
canonical: https://turbopentest.com/docs/tools/owasp-coverage
source: "TurboPentest Docs"
---

# OWASP Top 10 Coverage

## Coverage matrix

The table below maps the 14 Phase-1 tools to the **OWASP Top 10 2025**. Paladin is not listed here - it is the Phase-2 engine that reasons over all tool output and adds an analysis layer spanning every category (see below).

| # | OWASP Top 10 (2025) | Phase-1 Tools |
|---|---------------------|---------------|
| A01 | Broken Access Control (incl. SSRF) | Web Scanner, Vuln Scanner, Code Scanner |
| A02 | Security Misconfiguration | Vuln Scanner, Server Audit, Port Scanner, Web Scanner, Enumerator, Net Scanner, WAF Detect |
| A03 | Software Supply Chain Failures | Dep Scanner, Secret Scanner, Code Scanner |
| A04 | Cryptographic Failures | TLS Analyzer, Web Scanner, Vuln Scanner |
| A05 | Injection (incl. XSS) | Web Scanner, Vuln Scanner, Server Audit, Code Scanner |
| A06 | Insecure Design | Code Scanner |
| A07 | Identification & Authentication Failures | Web Scanner, Vuln Scanner, Server Audit |
| A08 | Software & Data Integrity Failures | Dep Scanner, Secret Scanner, Code Scanner |
| A09 | Security Logging & Monitoring Failures | - |
| A10 | Mishandling of Exceptional Conditions | Web Scanner, Vuln Scanner, Code Scanner |

## Paladin (Phase 2) - an analysis layer across all categories

[Paladin](/docs/tools/paladin) is TurboPentest's Phase-2 engine, not one of the 14 Phase-1 tools. Its specialist agents reason over the combined Phase-1 output, run their own active tests, validate exploits, and chain findings. This adds a reasoning layer that spans the entire Top 10 - and reaches design-level categories that scanners alone cannot cover well:

- **A01 / A05 / A10** - agents confirm access-control, injection, and error-handling issues with live proof-of-concepts rather than tool-reported signals
- **A06 Insecure Design** - surfaced through Paladin's threat modeling and STRIDE analysis
- **A09 Security Logging & Monitoring Failures** - assessed by Paladin's design-level review
- **AI/LLM targets** - the AI/LLM Security Analyst specialist maps to the OWASP LLM Top 10 2025, the OWASP AI Testing Guide, and MITRE ATLAS

## Notes

- Coverage extends beyond the Top 10: TurboPentest also aligns with the OWASP API Security Top 10 2023 and the OWASP Web Security Testing Guide (WSTG) 4.2.
- **White box tools** (Code Scanner, Dep Scanner, Secret Scanner) significantly improve coverage for A01, A03, A05, A06, A08, and A10.
- All findings include the mapped OWASP category when applicable.