My main market includes global banks and other financial services organisations, as well as some other industries such as oil and gas, and aside from standards such as PCI-DSS, ISO 27001 etc, the single de-facto standard across their web security teams is the OWASP Top Ten.