The Top 25 CWE list was first developed at the end of 2008 and is updated on a yearly basis. Approximately 40
software security experts provided feedback, including software developers, scanning tool vendors, security consultants,
government representatives, and university professors. Representation was international. Intermediate versions were
created and resubmitted to the reviewers before the list was finalized. More details are provided in the Top 25 Process