When comparing the testing methodologies of Open Web Application Security Project (OWASP) and Open Source Security Testing Methodology Manual (OSSTMM) the main difference is

OSSTMM covers a broad range of channels including data networks, telecommunications, and human factors, so web application testing is within its scope; it is not limited to non-web environments.

The distinction between OSSTMM and OWASP is not defined by gray box versus black box testing approaches, as both methodologies can be applied under various knowledge levels depending on the engagement.

This reverses the correct relationship; OSSTMM is the methodology that formally addresses and quantifies security controls, not OWASP.

OSSTMM (Open Source Security Testing Methodology Manual) includes a structured controls framework built around operational security metrics and Risk Assessment Values (RAVs), which measure the effectiveness of security controls in place across various channels. OWASP, by contrast, is primarily a guide for discovering and remediating specific vulnerability classes in web applications and does not provide a formal methodology for measuring or quantifying security controls. This distinction in scope - vulnerability identification versus controls assessment - is the core difference between the two frameworks.