2020-Community-Survey

2020 OWASP Community Survey
How would you rate your overall satisfaction with OWASP?

Count

Pct

5 - Very Satisified

252

38.0%

4 - Mostly Satisfied

281

42.3%

3 - Neutral

102

15.4%

2 - Mostly Negative

17

2.6%

1 - Very Negative

9

1.4%

No Opinion

3

0.5%

Total
How involved are you in OWASP activities?

664

4.13

Count

Pct

5 - Very Involved

91

13.9%

4 - Somewhat Involved

133

20.3%

3 - Occassionally Involved

242

36.9%

2 - Rarely Involved

137

20.9%

1 - Never Involved

52

7.9%

Total
What OWASP activities do you find most valuable? (Select all that apply)

655
Pct

Networking with others

360

55.0%

Local Chapter Meetings

402

61.4%

Global Conferences

152

23.2%

Regional & Local Events

288

44.0%

Monthly Newsletter

180

27.5%

OWASP Projects

411

62.7%

Training Events

217

33.1%

Count

Pct

I have never downloaded or used a Project

112

17.0%

Less than 2 projects

185

28.1%

Between 5 and 10 projects

280

42.5%

More than 10 projects

82

12.4%

Total
If you have downloaded Projects, how useful were they for you?

Score
3.38

Count

How often have you downloaded OWASP Projects?

Score

659
Count

Pct

5 - Very useful

199

38.6%

4 - Mostly useful

231

44.9%

3 - Hit and miss

76

14.8%

2 - Mostly not useful

0

0.0%

1 - Not useful

9

1.7%

Did not answer

146

Score

515

4.19

Total

1

2020-Community-Survey

What activities are you involved with on a regular basis? (Select all that apply)

Count

Pct

Training Events

140

21.4%

Events and Meetings

335

51.1%

Project Leadership

56

8.5%

Conferences

173

26.4%

Chapter Leadership

97

14.8%

Projects

157

24.0%

Since you’ve joined, how has the value of being part of the community changed?

Count

Pct

5 - Much better value

81

12.1%

4 - Mostly better value

217

32.5%

3 - About the same

282

42.3%

2 - Less value than before

41

6.1%

1 - Must less valuable than before

9

1.3%

Did not Answer

37

5.5%

Total

667

In your job, what is your typical security role?

3.51

Count

Pct

Breaker

118

17.7%

Builder

329

49.3%

220

33.0%

DefenderTotal
How long have you been involved in OWASP?

667
Count

Pct

Just over the past year

148

22.4%

Between one and three years

152

23.0%

Between three and five years

118

17.9%

Between five and ten years

155

23.4%

More than ten years

88

13.3%

Total
How long have you been a paid member of OWASP?

661
Count

Pct

Joined over the past year

72

12.0%

Between one and three years ago

71

11.8%

Between three and five years ago

51

8.5%

More than five years ago

55

9.2%

I am not a member

352

58.6%

Did not answer

66
Total

Score

601

2

2020-Community-Survey

What level of Membership do you have?

Count

Pct

Corporate Member

16

2.6%

Individual Member

268

43.2%

Not currently an OWASP Member

336

54.2%

Total
I currently hold an OWASP Leadership role (Chapter, Project or other)

620
Count

Pct

Yes

98

37.0%

No

167

63.0%

3

2020-Community-Survey

3/21/2020

How would you rate your overallsatisfaction with OWASP?

What factors most led to your rating above?

1 - Very Negative

Lack of curation in OWASP vulnerabilities. It is obvious that thevulnerabilities were created as a popularity contest, and the fact thatmany of the Top 10 vulnerabilities overlap has been ignored.

1 - Very Negative

You say you're open and transparent, but make a ton of decisions ina vacuum. Then announce this is what we decided.

1 - Very Negative

Weak attention to local chapters

1 - Very Negative

Complications and Bureaucracy.
Lack of communication with the foundation management
No clear plan to support local chapters, all are based on ad-hoc
request/response

1 - Very Negative

Interacting with the Foundation directly from my perspective as achapter President.

1 - Very Negative

Terrible communication, little to no support to regional events,
incompetent OWASP staff.

1 - Very Negative

the staff

2 - Mostly Negative

Little support

2 - Mostly Negative

Events cost to much for a non profit organisation which likely pays its
members large sums of money for the benifit

2 - Mostly Negativeslow response staff, request not handled correctly

2 - Mostly Negative

OWASP rulesets doesn't worked from the box even for Wordpress(false positive on ordinary actions), issue on github without attention.
Don't have analitics for treatments. Do I need parse logs by myself?

2 - Mostly Negative

No local invitations or events

2 - Mostly Negative

Our local Boston chapter has too many board members and isincredibly political. I would love to have more application security
content, but the only thing they can seem to organize on a regularbasis is BASC. I have tried to help out in the past, but there is noprocess for submitting talks or driving inbound content. As anorganizer of another local meetup, I am sadly disappointed withOWASP.

2 - Mostly Negative

I tried multiple times to create a chapter and received no assistance.

2 - Mostly Negative

Poor leadership and organization slipping into irrelevancy.

2 - Mostly Negative

No real visible added value above other organisations.

2 - Mostly Negative

Not standing by their own bylaws or board resolutions but giving in to
the few that yell the loudest or are a constant pest. It’s easy to say
yes.

2 - Mostly Negative-slow process/no response-too many low quality projects-poor quality of documentation/lack Q&A

2 - Mostly Negative

I do not agree with the new policies about the organization of thechapters - an example: I don't understand what happened to thePortuguese chapter!

2 - Mostly Negative

The lack of communication, effective processes, and significant lackof transparency is completely against the OWASP mission. And yet
we are there.

2 - Mostly Negative

Tried to contact some persons from OWASP Project but they neveranswer.

1

2020-Community-Survey

2 - Mostly Negative

I'd say that when corporate entities are permitted to push theirproduct via a top ten list, that would diminish my overall feeling thefirst letter in OWASP is being honored.

3 - Neutral

The organisation could be better run. For example, the mailing list isbasically a bunch of people arguing. However, I do value how thechapters are organised, plus OWASP is without doubt the authority
on appsec.

3 - Neutral

The initiative is awesome, and so is most of the community. TheOWASP emailing lists have been a bit toxic in the recent past. The
Board / Foundation seems to be disconnected from the rest of thecommunity. There's no clear path in terms of handling budgets eventhough discussions have been taking place for many months. Lots oftime and energy wasted into discussions that go nowhere.

3 - Neutral

OWASP do some good work but suffers from the (possibly correct)
perception that the organisation is as concerned with internal politics
and in-fighting as it is in moving the state of application security
forward.

3 - Neutral

My high level of satisfaction with the activities, conferences, projects,
and volunteers I've been involved with is countered by mydispleasure at the sense the staff and Board frequently choose not tohear or acknowledge concerns raised by chapter and project leaders,
particularly with regard to strategic changes and operating policies.

3 - Neutral

OWASP projects are poorly maintained, OWASP sticking to to top 10
factor when there are more than 10 common mistakes, mailing list ison the spammy side, etc

3 - Neutral

We are new to the OSWASP methodologies

3 - Neutral

Can do better with attack vectors and mitigation techniques

3 - Neutral

Seems it grew too much, too bureaucratic, not enough proper
technical people doing classic geek work.

3 - Neutral

It's fine, but you get the feeling that it could do much better.

3 - Neutral

i have been looking for an opportunity to connect with the local
OWASP chapter in Johannesburg to no avail . but i get newsletters
etc.. so.. its neutral

3 - Neutral

I just joined the community as official but there are no any benefit orlike that..

3 - Neutral

the migration to the new website resulted in many (like many manymany) empty pages and it's difficult to trace back to the original
pages with the information

3 - Neutral

Some things I like and some things I don't. I feel a little bit of an
outsider, but that is okay. It is not a failing. I deal with security and myjob is not security as I would rather it not adapt to me much.

3 - Neutral

Projects and tools are very good. Networking (local) and knowledge
sharing about techniques, tools and attack vectors is quite poor.

3 - Neutral

Lack of training for web applications security

3 - Neutral

I have not been to any event recently, and have not been engaged inreading newsletters.
This is not a comment against OWASP, just a reason behind therating.

3 - Neutral

Haven't been involved enough yet

3 - Neutral

I haven't had much time to be as involved as I'd like.

3 - Neutral
Not enough participation from the DC chapter of OWASP.

3/21/20202

2020-Community-Survey

3/21/2020

3 - Neutral

I have been a lifetime member of OWASP for a number of years
now, and I don't get anything from my membership. Not sure, should
I be expecting anything as a lifetime member?

3 - Neutral

OWASP is no longer the innovative open source organization I once
joined. It has become just another conference and chapter group.
Where are the cool projects?!

3 - Neutral

I do not understand why are you sending me emails to renew mysubscription when it was already renewed.

3 - Neutral

Local chapter is inactive, and many speakers are not inspiring.

3 - Neutral

Local chapter has become lame. No longer gets interesting
speakers.

3 - Neutral

I really am not getting a sense of community. I would like to see morebrick and mortar cheap training
opportunities/network/conference/community events. I would also liketo get CE credits for webinars and training venues. I haven't evenbeing contacted by the local OWASP Chapter. I don't even know if
there is OWASP Chapter in San Antonio, TX.

3 - Neutral

It seems in previous years presentations were more refreshing andexciting

3 - Neutral

Minimal involvement on my own part3 - Neutral

Updated info

3 - Neutral

Support from Foundation to Chapter

3 - Neutral

Used to be an important source of info and major contributor tosecurity industry; becoming less important as focus shifts

3 - Neutral

nothing

3 - Neutral

Rather short notice, and lack of support, to migrate content to new
website.

3 - Neutral

Good communication from the national HQ, but our chapter inRaleigh, NC, seems to be languishing.

3 - Neutral

Spoke with representatives about not receiving a membershiprenewal notice after attending OWASP SoCal last year. Was told in
email and I'm person that there was nothing that could be done aboutit.

3 - Neutral

Content is hard to find3 - Neutral

I did not directly involveed with the community recently

3 - Neutral

no factors, havent used owap lately

3 - Neutral

Nothing significantly new

3 - Neutral

I do not actively follow OWASP

3 - Neutral

Neutral Vendor

3 - Neutral

Some projects don't seem maintained (mobile top 10?), volunteers(mstg, wstg, cheatsheets, webgoat, juiceshop) don't seem to get thepraise they deserve. Planning was late with confs, website migration
had some poor management, leaders don't get mentored, anincrease of people being aggressive and disrespectful within owasp

3 - Neutral

OWASP seems to be about the same as it's always been.

3 - Neutral

More frequent outreach to drive engagement. Easier to find training,
conferences, meetups etc.

3 - Neutral

Hard to get support from owaso

3 - Neutral

OWASP holds a special place in my heart. I always read theseemails.

3

2020-Community-Survey

3/21/2020

3 - Neutral

I don't interact enough to have a strong opinion.

3 - Neutral

Since becoming a member, I thought there would be morecommunications other a trip to Mexico.

3 - Neutral

not an active member yet

3 - Neutral

Lack of time

3 - Neutral

Joined as a student member, but didn't receive any confirmation.

3 - Neutral

N/a

3 - Neutral

It lost relevancy and hasn’t been adapting to changing times. Only
thing known from Owasp is the top ten, which not sure it really helps
as people only refer to that.

3 - Neutral

I'm don't have visibility about how I can help at projects.

3 - Neutral

The work of local chapters is somewhat invisible.

3 - Neutral

not much involvement

3 - Neutral

Not aware of any materials updated...

3 - Neutral

The lack of support as chapter leader and the bad communication
between the chapter and OWASP Foundation, also a past event with
Dawn where she not take care of the work that we are doing and justinactive our chapter.

3 - Neutral

Security is worse than when I started. Some vulnerabilities like SQL
Injection, are older than my kids. OWASP should begin to influence
technocratic oligarchies to more secure outcomes. With the
exception of a few public and conspicuous cases, failure to secure
results in few if any punitive measures. Security of their data (akaour personal information) should never be optional. OWASP must
begin working to influence law makers around software policy as it
pertains to security. Alternatively, develop standards for code
certification processes like UL which will force industry to raise thebar. In any case, I don't think more or better technical tools are theanswer to industry wide security improvements we need.

3 - Neutral

There is a lack of broader dissemination of events.

3 - Neutral

Loved that Steve Gibson were invited!
Unfortunately I couldn't see him. But I liked that his talk was posted
on youtube.

3 - Neutral

Need to get involved more.

3 - Neutral

Local community activity

3 - Neutral* Website migration issues* Communication issues

3 - Neutral

The focus seems to more and more on organizing expensive
international events. Sharing knowledge on a local level is much
more beneficial. Also, including monitoring in the last owasp top 10
causes a lot of confusion: pentesters have no objective way ofmeasuring, and organizations have no clue to what level they should
invest in visibility and follow up. The advice for a pentester to ‘ask theorganization if they could have spotted an attack is really substandard’z

4 - Mostly Satisfied

There's not many events locally

4 - Mostly Satisfied

No room for those w/out a tech background. No one excluded me,
yet never felt anyone available to explain to a non techie how
OWASP does/is.

4 - Mostly Satisfied

Projects

4 - Mostly Satisfied

Good security guidance4

2020-Community-Survey

3/21/2020

4 - Mostly Satisfied

Some chapter inconsistencies.

4 - Mostly Satisfied

Availability of OWAPS' online resources and well-organized meetup
events

4 - Mostly Satisfied

There were too many global conferences last year, even though thecontent/community was good. I like the community support andprojects.

4 - Mostly Satisfied

Information

4 - Mostly Satisfied

Great tools, would like to see more and persistent participation atregional developer events like CodeMash, CodeStock, That,
CodeAPLouSA, etc.

4 - Mostly Satisfied

Local community involvement

4 - Mostly Satisfied

The improved website and the connector emails are HUGE steps in
the right direction! Love the investment in these arezs.

4 - Mostly Satisfied

I learn useful things from the talks

4 - Mostly Satisfied

Good guides and information. However, a lot of it is abandoned or
outdated or its status is not clear.

4 - Mostly Satisfied

The two events I went to were very well put together. The main issue
I've seen is relatively low participation from attendees andinvolvement from the community. Myself included :(4 - Mostly Satisfied

Practical/Hands-on training during meetups

4 - Mostly Satisfied

Quality of research.

4 - Mostly Satisfied

Networking

4 - Mostly Satisfied

Great resources; independent from vendors; almost no advertising

4 - Mostly Satisfied

Local chapter not very active

4 - Mostly Satisfied

I enjoy attending the local meetings but find involvement beyond the
local level confusing.

4 - Mostly Satisfied

Quarterly events are informative and good for meeting people.

4 - Mostly Satisfied

OWASP reach across the globe

4 - Mostly Satisfied

None

4 - Mostly Satisfied

A good initiative

4 - Mostly Satisfied

The ongoing projects, knowledge sharing and events.

4 - Mostly Satisfied

Only concerned with material shared for working.

4 - Mostly Satisfied

Great updates

4 - Mostly Satisfied

I sometimes use to search best practices.

4 - Mostly Satisfied

pushing forward api topics

4 - Mostly Satisfied

Good content

4 - Mostly Satisfied

As a chapter leader, I think we need more support from thefoundation. It's hard here in Latin America.

4 - Mostly Satisfied

Improve my skills about cybersecurity

4 - Mostly Satisfied

The staff does a fairly good job but could use even moretransparency and coordination with the community.

4 - Mostly Satisfied

Activities of OWASO, dedication of the members, quality of thematerials produced.

4 - Mostly Satisfied

Using the OWASP Dependency Check tool.

4 - Mostly Satisfied

Security Tools

4 - Mostly Satisfied

Excellent Testing framework
Broad reachMember led

5

2020-Community-Survey

3/21/2020

4 - Mostly Satisfied

Best for today's technology

4 - Mostly Satisfied

Some great resources which are clearly based on practicalexperience and are suitable to take into an organisation. One of thefirst sites to visit for practical security advice and help.

4 - Mostly Satisfied

Newsletter

4 - Mostly Satisfied

I have used a lot of the open source from OWASP but I see a slow
down in some of the feature velocity

4 - Mostly Satisfied

Information on Website
ZAP tool

4 - Mostly Satisfied

The top ten became political instead of practical, the local chapter
doesn't meet often enough, some of the standards such as the
OWASP Verification Standard are so large and cumbersome as to be
impossible to implement.

4 - Mostly Satisfied

I don’t interact with the organization much these days.

4 - Mostly Satisfied

I point developers at OWASP Projects to help them secure theircode

4 - Mostly Satisfied

Too many long-timers don't want changes that would improve theorganization, they prefer to keep things as-is (for example,
reasonable expense policies and non-restricted donations). That's
frustrating.

4 - Mostly Satisfied

As CISO, I find most of the tools I need. This might be moreaccessible though (i.e. easier to find).

4 - Mostly Satisfied

all it's correct

4 - Mostly Satisfied

Not enough time for presentations.
Too many 'finished products'.
You only get a taster of what's happening. Zap, for example, was a
15 minute talk through. It would have been far better if it could havebeen pointed at a site in a lab, sent on it's way, we moved onto
another topic and then came back to see the results.

4 - Mostly Satisfied

Lack of ability to direct membership funding without creating a newcontract.

4 - Mostly Satisfied

A bit difficult to get involved in projects

4 - Mostly Satisfied

OWASP does a good job overall in promoting security best practice

4 - Mostly Satisfied

Quality of Guides and Conferences

4 - Mostly Satisfied

Very good Israel conference a while back. Great attitude andeducational talks. Also met some interesting vendors.

4 - Mostly Satisfied

The initiative of teaching community

4 - Mostly Satisfied

The organization is great and the conferences and other material
they put out are top notch.

4 - Mostly Satisfied

ability to keep updated on industry trends

4 - Mostly Satisfied

Love all the free material, especially documentation

4 - Mostly Satisfied

Took a bit to find the Dallas chapter. I'd like it if the chapter seemed
more like an organization that does things than a series of eventswith no real organization.

4 - Mostly Satisfied

OWASP is covering web application related security issues ,however the way web application managed is changing fast, withdocker, serverless and cloud native application OWASP will need toenlarge it peripheral boundary

4 - Mostly Satisfied

mostly trusted source of info

4 - Mostly Satisfied

Updates and projects upgrades

4 - Mostly Satisfied

Smooth registration.

6

2020-Community-Survey

2020 OWASP Community Survey
What would you like to see added as an additional benefit for OWASP members?
Blockchain Security
I need to find how to be paid member :)Not sureOWASP has a lot of charm and I don't wish to come across hard but the world is a much more hostile place than when we started.
We need to increase our impact. We've won some battles but I'm not sure we are winning the war. I'd recommend reviewing Dan
Geer's Black Hat talk from 2014 for ideas.
There is no particularMore free local events and knowledge sharing.
Less focus on expensive international events that seem to follow the likes of blackhat USA (too commercial).
Only measurable items in the owasp top-10.
More communication and availability of detailed write-ups and recordings of talks and presentations.
more career development activities
I don't need any more benefits as an OWASP member. Keep focusing resources on maintaining high quality conferences,
supporting local orgs with speakers and financial support, and ESPECIALLY bring more people into to contribute to projects bydeveloping a university partnership program to get students to contribute and create new projects. There are lots of crazy smart
people in industry with OSS ideas that they don't have time for, and lots of students who want to learn and build something.
Additional training opportunities
Free membership
The board should listen to local communities and not make unilateral decisions.
A job board would be helpful for developers who are not on Twitter.
Invitation to present instead of same presenters and vendors.
Larger funding for chapter events and ads to help grow the number that turn up
Discussing the impact of external or third party code in addition to the inside/Owned and operated code. The holistic digital asset
including the digital supply chain.
More events, networking, training etc
Yes
Simply more chapter meetings. They were always great. I would join OWASP if such were available once again.
What would you like to see added as an additional benefit for OWASP members?
I'm hoping to see how I can help with projects or in my city chapter.
Images on vulnhub to use ZAP against
I am missing local events in
Slovenia. Nothing happens here
until this survey, I had no idea there was a membership
Maybe some swag or an annual party?
Software developers cyber security
SaaS users cyber security
Software platform cyber security
Training , more and more training opportunities and building individual through industrial attachments , for example job internships
for graduates.
More community event information and local/regional event communication.
Stickers!
Software tools that work on the Windows platform
nothing
I want to become an OWASP member for bangalore chapter. Need more guidance on thisI would like to see better local chapter meetups. Over the last two years the local meetups have been extremely infrequent,usually due to personal issues involving the chapter lead. There doesn't seem to be any kind of recourse for this; we just have todeal with lackluster meetings twice a year.
N/A

1

2020-Community-Survey

Unique identity
Having a way to know who is a member (status of the membership) to give rebates on events for example
I don't know yet
Project updates and information on how to make the most of my subscription.
I think we need some chanes at the foundation level. I as a chapter president am not getting the TIMELY support I need to be
successful.
More documentation and events
Membercard; GitHub Access to the organisation;
OWASP/IoT and all the UseCases to make "Controls for Securing IoT" in a large environment
Share with our RMF LifeBoat grouptraining
Better swag fro members.
Access to academic papers, more community outreach, etc.
It's charity. So I don't expect to get something in return.
Less ads from corporations maybe.
Create and support more OWASP Conference each country
Benefits for regular project contributors
In my opinion you guys are travelling well...so more of the same
More chapter events with educational content
Vuln machine for both breakers and builders
Cyber Range for web testing / vuln scanning.
A meaningful community built around chapters (or more local if needed).
A single platform. An interactive platform.
I wish I found easier ways to get involved in projects.
Probably, sponsoring opportunities for corporate members. As far as I see it is not spammy as self-selection sorts itself out (thetype of companies deciding to engage with OWASP).
Suggest a job board.
Top Ten training
More workshops and training for people new to the field. Maybe a way to partner experts up with new people at the workshops?
Jobs board.
Better meetings. They lack interest and communication.
Idk¯\_(ツ)_/¯
More education for corporate cyber security staff
Don't feel any improvements in OWASP:- Talks I visited were either boring (without technical details) or promote specific products. Local meetups are still ok though- For this year have not seing any interesting changes in any project I monitor
Hand-on training events!
Discount on learning materials on security
The meets should happen more often
Training courses like those offered by sans and portswigger
Discounts arranged with sponsoring vendors? Group insurance?
Anything that would most likely help a developer understand and deal with current security issues in both web and mobile apps
more frequent update and training events<img src=x onerror=alert(1)>One project that I haven't seen much movement and is really important is the Threat modelling one. It is very basic as far as I cansee. I am not sure whether I am wrong but there are no OWASP top 10, etc. included in the solution. There should be a solution
with a plug in with all features.

2

2020-Community-Survey

yesJust keep doing what you're doing
I want OWASP to increase its visibility to a bigger set of people
Education project and program
Maybe an OWASP Certification
Better promotion of OWASP output so our team can benefit from it.
Specialized training video
Keep up with new technologies, from a hackers perspective. Focus on exploiting and understanding of vulnerabilities. Too much
focus of appsec has changed to just building tooling in pipelines...no one knows what the results mean, and too much time goes
into triage to focus on pentesting and fixing root causes of issues.
A local chapter in Raleigh, NC
CPEs
A way to enable smaller and also online institutions to become recognized and then encourage student activity.
- Handson training session should increase- It would be great if OWASP community assigns a mentor for some question a month or quateri have no idea
I'm a lifetime member. Would love to see benefits for this level of membership that would draw more to join at this level. I don't
have an opinion of what that would be.
N/A
Is there a local OWASP chapter?
A social portal to connect people with my same interests.
Not sure, membership information is hardly disclosed by local chapter
Something that provides some value beyond what non-members get - an email address is nice but not particularly valuable.
Training for newly graduates to be prepared for job opportunities
In an ideal world vendor training events.
Swag shop
Really, I'd like to see better continuity between projects.
Nothing comes to mind. Tbh. I did not know about the OWASP projects. I will look into them. Thank you!
I truelly want the monthly news letters to be a one stop shop for the most important IT security related issues for the last month.
Getting that for free is maybe a bit too much to ask for but maybe these could be as a paid service that I would be interested in if
the content match my expectations. //tshirt and/or hoodie - would be happy to pay extra to get it
More Events For Fruitful Output
lo que necesiten para seguir trabajando para la comunidad
I’m happy keep up the good work!
Resources for security baseline architecture. E.g. secure default for setting up website with OAuth
I would like to contribute more to the documentation, but I don't have the access. I wrote more than 5 times to support, and noanswer.
To start strengthening membership. Our members should be the ones providing feedback to things like foundation policies andfinances decisions. These items should not be open just to individuals that attend chapter meetings.
chapter/project leader should be paid members like the board.
The board chooses yearly who they will grant honorary membership based on the service to the foundation.
Leaders list should be for OWASP confirmed leaders only and the discussion should be professional and respectful.
1 year Scholarship membership granted by board. Limited number per year based on agreed upon criteria.

YES
Something. Anything. It currently has no value other than voting.
To me the biggest benefit to the community is increased awareness amongst developers in general, not just to OWASP members.
Helping to move security from an afterthought to a core part of the development life cycle makes everyone's life easier, not justOWASP members. I think once more developers learn to make security a priority, more will specialize in it and reach out tobecome OWASP members.
More space for SME

3

2020-Community-Survey

Initiatives to engage and generate Projects and Jobs opportunity for Placement. Starting new Projects in fields of AI Penetration
Testing, Blockchain Forensics and AR-VR Security
I have not been updated by OWASP for last year but I'm keen on to engage OWASP projects and community
There are not many benefits as of today. Potentially discounts to online training platforms and a yearly shipment of OWASP swag
would go a long way.
I am going to seek paid membership. Please continue the access to CTFs.
more training! I need to get developers trained on how to defend against the OWASP Top 10, they're all cluess!
Nothing that I can think of.
Everyone used to be a member before, regardless of whether they paid or not. There should be no distinction.
Need a chapter in Washington, DC Metro
Certification
video tutorials
I never knew that there was a membership program
Nothing at this time, still getting my feet wet.
Easier for members and for the outside community to provide visible input to public projects especially if they have a suggestedchange.
I would welcome regular local meetings
Review of misconduct, for using owasp name in personal gain and in making nonsense media statement etc
Virtual chapter meetings where you can attend even if there isn’t a location convenient or near you.
Is very important to involve the people and try to figure out to how to accompany the different voluntaries to be part of OWASPThanks for your work, but remember that some actions can discourage very bad the people involved.
More funds for local training classes
Information about upcoming local meetings like time, location, etc.
More support to the project leaders; to have a quarterly/monthly project leaders support call.
None, it should be supported government/European governments.
N/A
Scholarships for events, trainings, and for chapter leaders also.
Online forums for questions and answers. Help with mentoring and knowledge.
Took part in Owasp Rest Security cheat sheet Workshop in 2017 2 days in Germany. Intensive great experience. I would likemore of those events.
Keep doing what you are doing!
Filling this form and thinking about the answers shows me that I shall support OWASP more :-)less politics would help for sure - or whatever needs to be clarified to be done before is dumped on the entire community. My 2
cents on this topic
More of everything...
Defined membership attributes. What do I get out of my membership, would like to know better.
nothing comes to my mind right now
More direction and standards to chapter; maybe quarterly topics to create commonality in social media and networking
conversations.
more close collaboration between the staff and the community.
put the projects first = they are our crown jewels
if you loose projects / project leaders, the overall value for our community lowers.
DEFCON village was really great start. More encouragement for contributions for vuln app development since they are such great
learning tools (and require more work that people think)
Question 'How often have you downloaded OWASP Projects?'
What if I had downloaded 2,3 or 4 projects? (None of the options cater for that). Also the question was how often not how many.
I'm not sure what I'd like to see as an added benefit for OWASP members but the local meetup in Bristol is very good, thank you
owasp.
Training
Better organization of information on the website.
Some ML monitoring tools for cloud42020-Community-Survey

Better employees of OWASPNo idea.
I like the current offer so farLess involvement and communication from prior leadership that have resigned positions.
More involvement of leaders who are internationally involved with appsec by actual day2day experience and work requirements.
An ED position not used as a puppet - rather one who leads without fear of the board.
Global conferences
I would like to show much more benefit as paid member but there are no. You may help me for that
More local events would be great.
I want to see LESS benefits for “members”. OWASP should be free and open for all. Reduce the paid “leadership” and return toa volunteer org where those that contribute the most gain the most responsibility. FOCUS on the mission, not training.
More objectives listed on the website.
not sure
Trainings
Felt content even without being a member as the community does a good job of sharing information to keep the softwareenvironment safe & secure.
Free courses, more local chapters activity for students to deal with lack of workforce in appsec
more local activities in Switzerland
I have been a member on and off. I hope to change it this year and bring a voice of diversity and inclusion to the discussion.
It would be great if we could work on getting additional discounts on industry tools like Burp Suite Pro, Shodan, and others. I workpart time in the ski industry and many vendors offer special discounts and pricing for team members.
Not a benefit, but the website needs to be much more specific about how to bring on a new OWASP project. There is a menu
item, but it brings one to a login page. Even if it's self-enrolment, this is really not inviting. Just one page detailing what kind of
projects are of interest and how one does go about it would be a huge improvement.
N/A
Discounted conference passes.
Just to open access for individual in my country ..do known how to escape from attack on their workplace ..help me out to built acompanies to educate them ..well in their bases academic skills .......please help us.....
Maintain the credibility
N/A
Discount in security products, free password manager, intro into security for the family(kids/wife/less technical spuse) tounderstand what we do and how it is valuable
Frequent Trainings and offers for other discount to events, trainings, active members clubcleanup of outdated projects and info
More slide decks that can be used to train others.
nothing particular.
It is unclear what any benefit of being a member is. As a non member I have attended many events but do not know what being amember means or would give me.
Connections to other underrepresented people
NA
More conference or training events
Continue to drive the initiative to find Security vulnerabilities
Curation
More local (Israel) talks about real-life deployments of security systems for SaaS and web security against online attacks andsocial engineering attacks. I.e. the theory and tools are important, but as a quality management engineer with the security brief, I
also need to hear from people who have actually deployed security mitigations in real companies with real people.
I'm not really sure what the benefits are (other than supporting a worthwhile cause)
N/A
Get more regional conference in MENA region.
work on weekly webinars
Senior membership discount. Membership dues being tax deductible.

52020-Community-Survey

4 - Mostly Satisfied

great events, interesting subjects

4 - Mostly Satisfied

Great organization, good presentation

4 - Mostly Satisfied

Good resources made available for all parties

4 - Mostly Satisfied- many sources of content- always keeping up to date with new topics

4 - Mostly Satisfied

Happy with the OWASP Hyderabad Chapter meetups

4 - Mostly Satisfied

Resources and events

4 - Mostly Satisfied

I would like to see smaller conferences. Best Example SecAppDev in
Belgium with Max 50 participants.
More contents and networking . No vendors

4 - Mostly Satisfied

I support the mission and values, however, it is difficult to get started
as an academic organization seeking to inspire students. The site did
not inform me about options correctly.

4 - Mostly Satisfied

A huge variety of resources, very easy to find information, but I don't
like some of the marketing communication (most of it is fine).

4 - Mostly Satisfied

very helpful in the every days live of an ISO, when it comes toprovide information for developers.

4 - Mostly Satisfied

Dealing with the foundation itself feels slow and unreliable, e.g.
outdated contact information, long time for replies or no replies at all.
Right now I don’t know how to renew my membership properly. I use
and refer to the projects frequently in my job, they provide greatvalue.

4 - Mostly Satisfied

The event rate and the topics

4 - Mostly Satisfied

Local chapter's activities and events. Slack channel. One negative isinability to find out how to engage with OWASPs projects (non-local)- seems those are very clicky/insular to an outsider.

4 - Mostly Satisfied

It has been kind-of long before we saw cloud-specific trainings/tools(SSRF, Metadata, etc...)4 - Mostly Satisfied

Local chapter seem to be doing a good job and keeping regular
meetups

4 - Mostly Satisfied

Attract on website analysis for me ..l did it.....

4 - Mostly Satisfied

I've been a chapter leader for a little over a year, and a projectcontributor for some time. In general, I am very pleased with the
dedication and amount of work being put in by the unpaid volunteersof the organization. However, there appear to be times where there
seem to be challenges with communication and awareness ofupcoming initiatives, changes, etc. being proposed at the top. I don't
know why this is the case, nor necessarily how it should be solved(maybe I can assist in the future if time permits) but I do believe thatOWASP - like so many other organizations - is suffering from thesame challenges many organizations face these days - namely, too
many communication options. In my opinion, it would be extremely
beneficial to OWASP, projects, leaders, contributors and the general
consumer to utilize a core set of channels for communication. My
initial thoughts would be to leverage the new website, email, and aconsistent, reliable videoconferencing/meeting platform. Slack,twitter, google groups, etc. are all nice tools but they just allow for
dilution and confusion of communication since everything is an
option.
Please consider streamlining communication. It will please most of
the people most of the time.

4 - Mostly Satisfied

3/21/2020

Good projects and knowledge. It could however do with somecuration.

7

2020-Community-Survey

4 - Mostly Satisfied

Community security

4 - Mostly Satisfied

Provision of basic security information, promoting security bestpractise

4 - Mostly Satisfied

Its truly an organization that focuses on security and making things
better.

4 - Mostly Satisfied

There is lots of great content provided to the community, but somegood projects are left alone. I would like to see how all this efforts aremaybe merged or taook advantage in some way

4 - Mostly Satisfied

Informative

4 - Mostly Satisfied

Good presentations and good/new security technologies

4 - Mostly Satisfied

Some notable projects such as the OWASP Top 10 appear to haveunwanted outside influence and potentially as a result there aresome vulnerabilities that better stand as examples of othervulnerablities. For example, XXE can be abused for local fileinclusion, but XXE can also be used properly. There is no proper
use for a vulnerablility, such as Injection, or Use of Components with
Known Vulnerabilities.

4 - Mostly Satisfied

I have enjoyed the meetings I have been able to attend, and makeregular use of information provided on the OWASP website.

4 - Mostly Satisfied

Promoting appsec by fostering new talent, networking, andawareness

4 - Mostly Satisfied

I enjoyed attending the Global AppSec DC 2019 conference.

4 - Mostly Satisfied

we from technical comunity of internet (Regional Registry of IP
Addressess for latinmerica didn't see much visibility from OWASP in
Security of infrastructure, for example, is more based to commercial
companies, but we think is very important that the top 10 practices ofowasp and also OWASP staff must participate more in LACNIC
meetings, inteernet governance forum, EU United nations, and also
there is a lack of attendants to the IETF and IEEE meetings where
thee crypto is mootyl developed and the security paradigm isshiftiing.

4 - Mostly Satisfied

Very little involvement. Lack of news on activities

4 - Mostly Satisfied

I love your work <3. I like standards and guides, i have learned on it
how to Pentest. Sometimes it could be more up to date or consistent.
But general at last they are.
I have idea: I need for e.g more precise description of how pentest
each web vulnerabilities.

4 - Mostly Satisfied

The danish team are doing great at organizing small eventsnot completely satisfied because i don't really see any benefit fromthe international team

4 - Mostly Satisfied

Great conferences
But not many meetups

4 - Mostly Satisfied

Good understanding and baseline for web app security assessments.

4 - Mostly Satisfied

Education and keeping up to date on issues

4 - Mostly Satisfied

Simple and straight forward

4 - Mostly Satisfied

Not very much chapter support from what I can tell

4 - Mostly Satisfied

Overall OWASP is the entity for application security.
Our internal processes have definitely space for improvements. From
the outside sometimes it feels like there's a lack of attention/support
from staff members and lack of steering from the board.

4 - Mostly Satisfied

3/21/2020

Content on documentation8

2020-Community-Survey

3/21/2020

4 - Mostly Satisfied

Projects, local chapters

4 - Mostly Satisfied

I get to go to some events, but I'm not sure how else I can contributeor be a part of OWASP

4 - Mostly Satisfied

Great projects.

4 - Mostly Satisfied

I do find OWASP projects and material very useful for my (and myteams) work

4 - Mostly Satisfied

Migration of the website. While I do agree that action needed to betaken, the current aftermath appears a bit drafted.

4 - Mostly Satisfied

I think OWASP is doing great work, but there is always room for
improvement. ;)For instance, I'd like to see more activity on the IoT related projects.
If time permits, I'll try to get involved, I certainly understand that thisis a community effort after all.

4 - Mostly Satisfied

I really like all the effort done by the community and OWASP ingeneral but there is something that I don't like,
I am Leader of a chapter from South America and I think we are notrepresented at all, We feel that OWASP Global have hindered us
instead of helping us to hold events and bring OWASP to thecommunity outside EEUU.

4 - Mostly Satisfied

When I have used the site or gone to a meeting it was very helpful
and informative.

4 - Mostly Satisfied

Great show overall. Would have been nice to have more time to meetwith people between talks & trainings

4 - Mostly Satisfied

OWASP provides a lot of tools, standards and information to help
Engineers across the world for free.

4 - Mostly Satisfied

I feel OWASP is doing it's best to make sure we are developing in asecure manner

4 - Mostly Satisfied

After a long time there is a new OWASP website but still not all
previous pages have been migrated

4 - Mostly Satisfied

The passion and commitment of the people in owasp and thesacrifice they make in time to help others with great projects.

4 - Mostly Satisfied

The community share framework, projects, training, events to secure
software applications.

4 - Mostly Satisfied

Software like zap, dirbuster,... owasp testing guide4 - Mostly Satisfied

great source of knowledge.

4 - Mostly Satisfied

Join up of projects not always clear

4 - Mostly Satisfied

Would enjoy some workshops in the Seattle area

4 - Mostly Satisfied

Some problems with the Mobile top 10, but mostly resolved.

4 - Mostly Satisfied

Continuous improvement

4 - Mostly Satisfied

Local owasp leader is very good (Bristol, uk)

4 - Mostly Satisfied

Limited local opportunities

4 - Mostly Satisfied

Lack of quality leadership in board.
Lack of vision from ED.
Loss of quality leaders in global Owasp org.

4 - Mostly Satisfied

Good content, good group

4 - Mostly Satisfied

Interesting subjects, current topics, relaxed atmosphere4 - Mostly Satisfied

Best practices provider.
One stop shop for web security.
Local security community engagement.

4 - Mostly Satisfied

It is ok support, but at times some processes are confusing9

2020-Community-Survey

4 - Mostly Satisfied

Local chapter has low level of activity.

4 - Mostly Satisfied

web resources, appsec cali

4 - Mostly Satisfied

Not sure what I'm getting, besides owasp top 10.
Do you have a legal arm?

4 - Mostly Satisfied

I greatly appreciate what OWASP is doing to serve the needs of the
many. I also thank the Denver chapter for their amazing work anddedication to the profession.

4 - Mostly Satisfied

This year I worked extensively with the ZAP api to build custom tools.
Your new documentation is vastly superior to what existed before
and made the process so much easier. Thanks Simon ;)4 - Mostly Satisfied

Not enough local chapter meetings

4 - Mostly Satisfied

The amount of documentation with regards to web application
security and how it helps security professionals on such engaments.

4 - Mostly Satisfied

The content, brand, projects, and so on are great. The day-to-day
support from OWASP is great for Chapter leads. However, the website is still pretty terrible and the mailing list/website migration efforts
were chaotic. I realise that these efforts are mostly run by volunteers
or people who are very strapped for time and resources, so it's
actually a miracle it went off as well as it did. More frequent/clearer
leader communications would be helpful.
The sponsorship and funding debates are necessary, but the current
allocation of corporate and conference sponsorship funds has madeit increasingly difficult to run a chapter and/or start a local conference
in a big city, so outreach activities are becoming harder and harder todo. Our chapter is very lucky to have sponsors, but the toll on
volunteers to continually be scraping up sponsors, speakers, andhandle other logistics for every event limits what we can do without
making running the chapter a near-full-time job for someone. And
conferences would be even harder. We're still calculating whether or
not it's even doable/worth the risk under the current fund allocation
amounts and in the current environment of uncertainty.

4 - Mostly Satisfied

Helpful and insightful meet- ups and events

4 - Mostly Satisfied

communication, access to resources

4 - Mostly Satisfied

Very usefull projects, very active community, a "de facto" standard
for web application security

4 - Mostly Satisfied

I am a heavy user of ZAP. It works really well in many cases, but it
has challenges with javascript heavy applications and SOAP api's.
We also use some of the sample vulnerable apps for training
purposes.

3/21/2020

4 - Mostly Satisfied

The have great material but open source projects need more hands.

4 - Mostly Satisfied

Quality of security guidance, variety of documentation provided

4 - Mostly Satisfied

Knowledge transfer

4 - Mostly Satisfied

Great community, great projects

4 - Mostly Satisfied

Owasp is a great and amazing organization, however they can
support better the chapters send stikers and motivate their tocontinue the chapters meetings.

4 - Mostly Satisfied

Improvements are being made.

4 - Mostly Satisfied

Local Chapter actifities

4 - Mostly Satisfied

Local community meetings

10

2020-Community-Survey

3/21/2020

4 - Mostly Satisfied

Owasp top 10 project4 - Mostly Satisfied

the quality of work done by the organization

4 - Mostly Satisfied

good intentions, spotty execution

4 - Mostly Satisfied

I like OWASP but they're not great at communicating.

4 - Mostly Satisfied

I never give a 5, b/c there is always room for improvment.

4 - Mostly Satisfied

There are always things that need to be improved.

4 - Mostly Satisfied

I like the code projects like Goat that assist with learning.

4 - Mostly Satisfied

High quality documents and projects, but low engagement ofchapters in Brazil

5 - Very Satisified

OWASP is influential and open, and the projects are valuable for awide range of security activity.

5 - Very Satisified

Clear, educational and responsive to industry changes

5 - Very Satisified

The OC chapter is very active. They get very good speakers. I learnsomething new every time I go, as well as meet cool people.

5 - Very Satisified

For education purposes it’s gives unlimited guidance.

5 - Very Satisified

The chapter meetings are very informative

5 - Very Satisified

Helpful resources and tools

5 - Very Satisified

Great local chapter, quality web content (top 10), and I enjoy the
podcasts.

5 - Very Satisified

Quality of content

5 - Very Satisified

The Owasp projects.

5 - Very Satisified

Metodoloy guidelines and best practices

5 - Very Satisified

Everything

5 - Very Satisified

ability to contribute to owasp, and operate my chapter

5 - Very Satisified+open source contribution+Complex evolving threats and vulnerabilities

5 - Very Satisified.

5 - Very Satisified

Owasp always help me in my intrusion tests in my professional lifeand personal life. The community help me so much creating steps bysteps in many areas in a web pentest, I like so much.

5 - Very Satisified

I attended the D.C. 2019 OWASP conference, and have used
OWASP resources countless times throughout the course of my job.

5 - Very Satisified

Basically, I am using OWASP as a reference for my own projects,
trainings and etc.

5 - Very Satisified

The availability of resources and tools to help in sw assurance

5 - Very Satisified

Great talks and events

5 - Very Satisified

Positive Influence around a safe cyber world

5 - Very Satisified

Fantastic resources

5 - Very Satisified

Informations

5 - Very Satisified

Active community, awesome resources and projects

5 - Very Satisified

i am receive best knowledge from owasp foundation

5 - Very Satisified

quality of the results from the projects

5 - Very Satisified

Rich documentation provided to the community with relevant anduseful information

5 - Very Satisified

As a new in the community it was great for me to getting some
information, sharing experiences and so on.

112020-Community-Survey

3/21/2020

5 - Very Satisified

I use OWASP guidance on a regular basis and I'm satisfied with theContent and the coverage.

5 - Very Satisified

Content of events

5 - Very Satisified

Name Recognition in the Security Community. Great educational
programs. Involvement of professionals in the field. Great website
presence.

5 - Very Satisified

High quality events and great networking in LA area

5 - Very Satisified

Great resources

5 - Very Satisified

Quality Info

5 - Very Satisified

software, projects, documents

5 - Very Satisified

The layer of Transparency

5 - Very Satisified

Content and accuracy

5 - Very Satisified

Meetings and conventions (SnowFROCC)

5 - Very Satisified

Quality of content, people

5 - Very Satisified

OWASP open source projects - Cheat sheets, OWASP top 10, Active
controls, Web Goat, ZAP among others.

5 - Very Satisified

Involvement in local chapter

5 - Very Satisified

Materials and vendor independence.

5 - Very Satisified

Owasp Top 10

5 - Very Satisified

Active support of OWASP is providing global secure coding practices

5 - Very Satisified

My local chapter always has quality meetings, is well run andorganized, and provides me with the opportunity to learn.

5 - Very Satisified

Welcoming environment. Technical presentations without getting into
the weeds.

5 - Very Satisified

Contribution to the community of good practices.

5 - Very Satisified

OWASP consistently brings in good speakers. They are intelligent
and engaging. They are specialist and they talk on specific topics ofinterest. OWASP lines up a good variety of speakers. All very
good.

5 - Very Satisified

Available, Open, Comprehensive

5 - Very Satisified

1. Flagship mature projects receive the attention and resources theyneed
2. There is an increasing push towards more transparency inmanagement
3. The OWASP brand continues to be the de facto security standard

5 - Very Satisified

Collaborative learning, conference, support from people

5 - Very Satisified

Great resources

5 - Very Satisified

local meetings. Updating top 10. API top 10. IoT top 10

5 - Very Satisified

Highly engaged local community in the Salt Lake City Chapter
Constant outreach to bring new people in. Very interesting
discussions.
Adding value on each meeting.

5 - Very Satisified

Transparency and Free of Cost resource Availability

5 - Very Satisified

Improve software security. Amazing open source projects. Highquality resources

5 - Very Satisified

Openness

5 - Very Satisified

multiple document
great quality
actual topics

12

2020-Community-Survey

3/21/2020

5 - Very Satisified

just great events but would love to see more.

5 - Very Satisified

The events I have attended are well organized and interesting.

5 - Very Satisified

The site is full of information. The tools provided and the site fortesting against is great. I haven't used the tools yet but it is on my to
do list.

5 - Very Satisified

Tools, documents and all resources provided by owasp

5 - Very Satisified

Dedicated local chapter - excellent chapter leads

5 - Very Satisified

Training labs like Juice Shop.

5 - Very Satisified

The information that it provides to the community

5 - Very Satisified

OWASP (the community, its training resources, and projects) havehelped me to get into the field of application security during the pastyear.

5 - Very Satisified

I went to the OWASP London Women in Appsec meetup and learnt
so much. Absolutely loved it!

5 - Very Satisified

communication, community, ease of use of website

5 - Very Satisified

Advisories, discussion etc

5 - Very Satisified

Great topics, great people, nice venues

5 - Very Satisified- Regular meetups are being setup- Networking of the security community- Most of all questions searched on security end up at OWASP
website5 - Very Satisified

I appreciate your effort a lot like workshops and Meetups.

5 - Very Satisified

Good coverage of vulnerable areas in security

5 - Very Satisified

Great info

5 - Very Satisified

I have a lot of information about website security

5 - Very Satisified

1. engaging tasks like ctf
2. enlightening talks at sf most visible companies
3. a host this is punctual, clear, and sometimes funny

5 - Very Satisified

Very good presentations

5 - Very Satisified

Good events, good information

5 - Very Satisified

High quality materials and recommendations on application security

5 - Very Satisified

Networking

5 - Very Satisified

toda la documentacion y herramientas que hay

5 - Very Satisified

Global AppSec

5 - Very Satisified

Social Engagement, Newsletter, Event Managements andCommunity Engagement !

5 - Very Satisified

Great community that wants to improve security across the board.

5 - Very Satisified

testing guides, check lists, cheat sheets open source tools withrespect to Web Application , Mobile Applications, API Security, Web
services Security are invaluable guidance to carry out Vulnerability
assessments.

5 - Very Satisified

OWASP provides me with information that matters to me

5 - Very SatisifiedExcellent guides for information security

5 - Very Satisified

The content OWASP provides to the community - web content, ZAP,
etc.

5 - Very Satisified

the netwokring i am getting their

5 - Very Satisified

All the great people I have met

13

2020-Community-Survey

5 - Very Satisified

Technical presentation help learning from more experiencedeveloper and security pro.

5 - Very Satisified

Detailed information about the vulnerabilities, their impact and good
way of depicting the proof of concept generation process.

5 - Very Satisified

I love the community

5 - Very Satisified

I like the things which are coming out of OWASP.

5 - Very Satisified

That we are learning everyday from the OWASP projects andprograms about security

5 - Very Satisified

The tools and documents provided by OWASP and how everybody(who wants to) can contribute.

5 - Very Satisified

Largely the community interaction.

5 - Very Satisified

Great events.

5 - Very Satisified

The atmosphere, the speakers, the sessions, the people. I loved itall.

5 - Very Satisified

Projects and documents for community

5 - Very Satisified

excellent member supported education and tools

5 - Very Satisified

have been exposed to more programs and more of a hands on
experience every since I joined.

5 - Very Satisified

Good Meetups

5 - Very Satisified

because it's an amazing and great community

5 - Very Satisified

Community involvement

5 - Very Satisified

Informative in all aspect of I.T security

5 - Very Satisified

OWASP is free to use and contribute so it's community driven for themost part.

5 - Very Satisified

Useful reference resource

5 - Very Satisified

The overall top 10 OWASP API security

5 - Very Satisified

The OWASP provided a bunch of knowledge

5 - Very SatisifiedExcellent speakers. Great food.

5 - Very Satisified

OWASP conferences inspire people. OWASP personel encourage
peopel towards career development.
Note that I think OWASP is usually WAY behind the times. I go to
DEFCON for keeping up with the times. I find OWASP verysatisfying because I've really lowered my expectations for theorganization. I don't expect it to help keep me current; I use
DEFCON for that. I don't expect its Top 10 and other projects to bedelivered in time to be useful; I use internal resources at the (hugecompany I work for) for that. OWASP, like any volunteer
organization does have serious shortcomings, but I've learned to livewith those, and to appreciate OWASP for the community it offers,
which is something that OWASP does well.

3/21/2020

5 - Very Satisified

Projects and research openly available.

5 - Very Satisified

Availability of information and meetings

5 - Very Satisified

I like the events (mostly meetups) organized in my area (SanFrancisco). They are always very educative.

5 - Very Satisified

high quality materials available as a community effort

5 - Very Satisified

all the information available about secure coding

5 - Very Satisified

Quality, Contents and resources

5 - Very Satisified

Learnt lots14

2020-Community-Survey

3/21/2020

5 - Very Satisified

Using the OWASP top ten and ZAP

5 - Very Satisified

OWASP takes huge efforts to secure cyber space. Provides in detailand easy documentation.

5 - Very Satisified

Top 10; Juice Shop training; guidance/advice; ZAP; cheat sheets

5 - Very Satisified

Interactions with member and superior technical content. Your
Owasp top 20 vulnerabilities demonstrate your groups understanding
and dedication to the community

5 - Very Satisified

Usefulness of information received

5 - Very Satisified

Learning relive the information

5 - Very Satisified

Information content and quality, tools availability.

5 - Very Satisified

The updates to existing projects and the enthusiasm from thecommunity about the new projects

5 - Very Satisified

Information, communication and. community.

5 - Very Satisified

Vendor neutral, new interesting topic and moderator every time

5 - Very Satisified

Great Organization

5 - Very Satisified

learning,tools and projects

5 - Very Satisified

Great information and education opportunities, love the local monthly
meet-ups.

5 - Very Satisified

Relevant, pragmatic and open information and tools, straight from thetrenches

5 - Very Satisified

Amazing tools and guides.

5 - Very Satisified

The projects OWASP provides are great for quickly setting up test
and training environments.
The regular chapter meetings provide great opportunities for
networking with other members of the local community. The free foodis nice too.

5 - Very Satisified

The chance to hear ITSEC related topics

5 - Very Satisified

Overall quality of security and privacy education and resources.

5 - Very SatisifiedExcellent technical content, superb London chapter sessions. I've notyet seen a single presenter who want absolutely excellent.

5 - Very Satisified

Every time I go to an OWASP meeting, I gain valuable knowledge.
Keep it up, OWASP.

5 - Very Satisified

OWASP is an excellent initiative and resource, both in helping todrive awareness of best practices and also as a community aroundwhich to organize and share.

5 - Very Satisified

Great support and depth of knowledge. Great board as well!

5 - Very Satisified

The Constant Approach To Make All The Trainings And Conferences
Effective & Productive To All.

5 - Very Satisified

connecting with people and getting insights to better security

5 - Very Satisified

OWASP is a leader in sharing knowledge on web vulnerabilities.

5 - Very Satisified

Community engagement and transparency

5 - Very Satisified

Events, guest speakers, meetup Groups, information on the mostcommon vulnerabilities

5 - Very Satisified

The depth of knowledge of the invities

5 - Very Satisified

The information provided and the output the organization delivers

5 - Very Satisified

My industry trusts the information found here.
recognized as a leader.

It is globally15

2020-Community-Survey

3/21/2020

5 - Very Satisified

In the current cyber threat landscape the good guys really need tocollaborate as much as possible as the bad guys. OWASP justprovides that sort or platform to share experience and information.

5 - Very Satisified

Current information on mitigations and issues

5 - Very Satisified

When I need some information about Web Security, I can awlays findit at OWASP

5 - Very Satisified

The quality of speakers

5 - Very Satisified

I am a professional in the SAST space, appreciate your work

5 - Very Satisified

faster response in list

5 - Very Satisified

useful information

5 - Very Satisified

Great projects going on, excellent training and conferences

5 - Very Satisified

I learn a great deal at the Meetups and yearly daylong event.

5 - Very Satisified

The knowledge gained is enormous

5 - Very Satisified

The (prevention) cheat sheets are a big help in my work as anapplication security consultants, and linking to them after having
described the vulnerabilities in the application at hand saves me a lotof time. And it gives me backing in that it is not my own paranoid
thoughts I'm trying to convey.
ASVS, OpenSAMM, Testing Guide, and other resources are also
something that I use occasionaly - and that I want to use more.

5 - Very Satisified

Local Austin chapter meetings and activities; LASCON

5 - Very SatisifiedExcellent security testing and controls reference documentation.

5 - Very Satisified

The website, the objectives, and the plans.

5 - Very Satisified

OWASP does a lot of things right. My local chapter always has
interesting presentations and stuff going on, and in addition theorganization as a whole via their projects are nearly indispensible.

5 - Very Satisified

Outstanding documentation, Very effective projects and over allcommitment to the security community.

5 - Very Satisified

The OWASP APPSEC CONFERENCES

5 - Very Satisified

Cadenced meet-ups, workshops and SnowFROC

5 - Very Satisified

Great resources, great community, great conferences

5 - Very Satisified

The community is exactly what I needed to further my career. The
networking and training has been phenomenal.

5 - Very Satisified

Free tools and best practice references

5 - Very Satisified

All thing OWASP delivers to the community, like local meetings,
documents, frameworks etc.

5 - Very Satisified

The provide good speekers.

5 - Very Satisified

Projects

5 - Very Satisified

This is a great community that helps giving AppSec the attention it
deserves

5 - Very Satisified

The educational value that is provided is awesome.

16