“But my message to everybody listening to this podcast is the order is unimportant. Do all of them because it's only 10 things.”

Transcript evidence from Andrew Van Der Stock -- The New OWASP Top Ten.