Zero percent direct object references? Three possibilities:

* IBM doesn't know what an insecure direct object reference is.

* I don't know what an insecure direct object reference is.

* IBM's scanning tool is routinely missing an extremely common sev:hi bug class.

The OWASP Top 10 is stupid. For some reason, every attempt at creating a taxonomy of security flaws of any sort fails, and OWASP's is a textbook example. But at least 8 out of the 10 flaws OWASP randomly selects are still common and meaningful.