I hear you on OWASP in fact. I think the earlier iterations of it were more useful to developers. It focused on very specific vulnerabilities and it was a lot

I hear you on OWASP in fact. I think the earlier iterations of it were more useful to developers. It focused on very specific vulnerabilities and it was a lot more concrete. Now it has morphed into a much more abstract taxonomy of vulnerabilities and covers mobile as well as web. I think security people love this stuff, but it's much less directly useful to a normal dev. It has very good brand recognition though! Even management types have heard of it, which is unusual for a security standard!