Hacker News Reader

OWASP is a not-for-profit industry group not a governmental initiative.

However it's generally the most used "standard" for web application security and some regulations will use OWASP projects as references for what things should be considered for security

Yes, I'm guessing you haven't ever Googled 'web app security' or similar.

We use their dep check on java microservices, to make sure we're up to date on mitigations.

Yes. Its an important bullet point in RFPs for enterprise software.

So OWASP compliance is a thing as much as GDPR compliance in the enterprise world?

Not really.

GDRP results in major fines thus has major funding. OWASP is something someone might tack on, but most of the people involved have little to no ability to check.

No. There is no such thing as OWASP certification. The only teeth OWASP "compliance" might have is a contractually agreed MUSTFIX disposition for vulnerabilities that are on the OWASP Top 10 (which would be pretty silly and is not something I've ever seen done).