# OWASP ServerlessGoat

OWASP ServerlessGoat is a Secure Code Training product. It runs in the cloud. Pricing is free.

A serverless application that demonstrates common serverless security flaws and weaknesses

Checked October 2026.

## What is OWASP ServerlessGoat?

This serverless application demonstrates common serverless security flaws as described in the Serverless Security Top 10 Weaknesses guide.

Teach developers & security practitioners about common serverless application layer risks and weaknesses.

Educate on how serverless application layer weaknesses can be exploited.

Teach developers & security practitioners about serverless security best-practices.

You can find more information about WebGoat at: https://www.owasp.org/index.php/OWASP_Serverless_Goat

Tags: Serverless

## Where it fits in your security program (NIST CSF 2.0)

- [Protect](https://cybersectools.com/guides/building-protect-program-small-team): helps you prevent attacks and keep data safe.

## Quick facts

- Category: [Application Security](https://cybersectools.com/categories/application-security) · [Secure Code Training](https://cybersectools.com/categories/secure-code-training)
- Deployment: Cloud
- Company size fit: Startup, SMB, Mid-Market
- Pricing model: Free
- GitHub stars: 328
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best Application Security Solutions for Business](https://cybersectools.com/shortlists/best-application-security-solutions).

## OWASP ServerlessGoat FAQ

### What is OWASP ServerlessGoat?

OWASP ServerlessGoat is a product in the Secure Code Training category. It covers Serverless.

### What is the pricing for OWASP ServerlessGoat?

OWASP ServerlessGoat is free. Download and setup instructions are at https://github.com/OWASP/Serverless-Goat/.

### What are alternatives to OWASP ServerlessGoat?

Alternatives to OWASP ServerlessGoat listed on CybersecTools:

1. [Hacksplaining for Teams](https://cybersectools.com/tools/hacksplaining) - Security code and AI security training platform for developers (Commercial)
2. [Security Compass Application Security Training](https://cybersectools.com/tools/security-compass-application-security-training) - A role-based application security training platform that provides developers with courses and hands-on labs to build secure development expertise and meet compliance requirements. (Commercial)
3. [Checkmarx Codebashing](https://cybersectools.com/tools/checkmarx-codebashing) - Secure code training platform for developers with personalized learning paths (Commercial)
4. [BSG Web Application Pentester Training](https://cybersectools.com/tools/bsg-web-application-pentester-training) - Online web app pentesting training program with certification exam (Commercial)
5. [PentesterLab Master Advanced Web Hacking](https://cybersectools.com/tools/pentesterlab-master-advanced-web-hacking) - Online platform for web app security training via hands-on labs and code review (Commercial)

Compare all OWASP ServerlessGoat alternatives at [https://cybersectools.com/alternatives/owasp-serverlessgoat](https://cybersectools.com/alternatives/owasp-serverlessgoat)

### What deployment and organization size does OWASP ServerlessGoat fit?

OWASP ServerlessGoat is available as a cloud service. It is listed for startups, small businesses and mid-market companies. It is free.

## Compare OWASP ServerlessGoat with similar solutions

- [OWASP ServerlessGoat vs Hacksplaining for Teams](https://cybersectools.com/compare/hacksplaining-vs-owasp-serverlessgoat)
- [OWASP ServerlessGoat vs Security Compass Application Security Training](https://cybersectools.com/compare/owasp-serverlessgoat-vs-security-compass-application-security-training)
- [OWASP ServerlessGoat vs Checkmarx Codebashing](https://cybersectools.com/compare/checkmarx-codebashing-vs-owasp-serverlessgoat)

All alternatives to OWASP ServerlessGoat: [/alternatives/owasp-serverlessgoat](https://cybersectools.com/alternatives/owasp-serverlessgoat)

---

Source: https://cybersectools.com/tools/owasp-serverlessgoat

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on OWASP ServerlessGoat: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md