Web security and pentesting is the practitioner side of application security — finding vulnerabilities in web apps and APIs, exploiting them in controlled environments, and reporting or fixing them. The OWASP Top 10 (current edition: 2021, with a 2025 revision in progress) defines the canonical bug categories.
The work splits between offensive (penetration testing, bug bounty hunting, red team work) and defensive (secure code review, threat modeling, security architecture). Most courses lean offensive because the work is more visible and more lucrative through bug bounties on HackerOne / Bugcrowd / YesWeHack platforms. The defensive skills compound for engineers who eventually move into platform security roles.