OWASP Top 10 2025: What Changed and Why It Matters

If your security checklist is based on the 2021 OWASP Top 10, it's outdated. The 2025 edition reordered critical risks, added two new categories, and reflects four years of real breach data that contradicts what most teams are still defending against. Here's what changed and why it matters for your web application security program.

What Is the OWASP Top 10?

The Open Worldwide Application Security Project (OWASP) maintains the OWASP Top 10 as a prioritized awareness document for web application security risks. It represents consensus among security leaders on which risks appear most frequently and cause the most damage.OWASP analyzed over 175,000 CVE records, bug bounties, and practitioner surveys to rank these 10 categories. 

Prevalence doesn't equal your specific risk. A top-ranked category may matter less depending on how you handle sensitive data and your threat exposure.

OWASP Top 10 2025: All Ten Categories

What Changed From 2021 to 2025?

The shift signals OWASP moving beyond code vulnerabilities toward root causes and ecosystem-level threats. Modern web application security programs must address these systemic risks.

Understanding the Ten OWASP Categories

A01:2025 Broken Access Control

Broken access control means users can see or modify data they shouldn't reach. An e-commerce platform lets customers view other shoppers' order history by changing an order ID in the URL. A restaurant admin portal allowed staff to modify commission rates by guessing sequential user IDs. 

Manual pentesting uncovers broken access control through role-based testing of sensitive data access, parameter tampering, and business logic validation. Typical severity: high to critical. Automated scanners can detect some authorization flaws, like missing access checks on exposed endpoints. But they miss authorization logic that depends on application context: whether a manager can modify another manager’s data, if a customer can transition an order through states they shouldn’t control, or if role hierarchies actually enforce what the code claims.

A02:2025 Security Misconfiguration

Security misconfiguration moved from fifth to second place, reflecting the risks of cloud adoption. Default credentials in production, overly permissive bucket policies, debug mode enabled in live systems, unnecessary HTTP methods. A fintech firm left Terraform state files with API keys in a public repository. A healthcare startup deployed Kubernetes with network policies that defaulted to allowing all traffic.

A03:2025 Software Supply Chain Failures

New in 2025 and third-ranked, this category expands on what was previously called Vulnerable and Outdated Components. It now covers compromised dependencies, malicious packages, insecure CI/CD pipelines, and ecosystem-level risks. A team pulled in a popular npm package that was later compromised with a backdoor that stole environment variables. Another organization's build pipeline allowed unapproved deployments, letting an attacker inject a web shell.

Supply chain failures exist outside your codebase in registries and build systems. Scanners cannot detect compromises at the source. Remediation involves dependency inventory, provenance verification, secure pipelines, and automated patching.

A04:2025 Cryptographic Failures

Dropped from second to fourth place, this covers unprotected sensitive data, weak algorithms, inadequate key management, and improper transmission. A mobile app stored passwords in plain text in local storage. A database used MD5 hashing instead of modern algorithms. An API transmitted sensitive data, such as credit card numbers, over HTTP. Cryptographic failures require code review and business context.

A05:2025 Injection

Untrusted input becomes part of a command or query. SQL injection, NoSQL injection, OS command injection. An attacker submitted "admin'; DROP TABLE users; --" and the application concatenated it into a query. A search parameter let attackers inject HTML to steal session cookies. Traditional WAFs catch obvious patterns but miss context-aware attacks exploiting specific business logic.

Chained injections create high-impact paths. Prevention relies on parameterization, contextual encoding, input validation, and least-privilege database accounts. Severity: high to critical.

A06:2025 Insecure Design

A flaw in how systems are architected before writing code. Missing threat modeling, no abuse case analysis, weak authentication flows. A password reset sent an email with a predictable, non-expiring, reusable token. An application allowed unlimited login attempts with no rate limiting. An API didn't verify whether fund transfer source and destination belonged to the same user. Design flaws require threat modeling, architecture review, and business logic testing. Scanners cannot evaluate whether authentication architecture is sound. Severity varies but is often critical when chained.

A07:2025 Authentication Failures

Account takeover risks span credentials, recovery flows, sessions, and automated attack prevention. Weak password policies, reusable credentials, missing MFA, and unvalidated session tokens enable compromise. An authentication system accepted passwords from common lists. A session token remained valid for six months. Credential stuffing attacks brute-forced accounts simultaneously.

Scanners check for MFA presence but cannot evaluate session management quality. Manual testing includes authenticated role testing, session validation, and attack simulation. Severity: high to critical.

A08:2025 Software or Data Integrity Failures

Untrusted updates, unsigned code, insecure deserialization, malicious plugins. A platform allowed unsigned plugin uploads. An attacker uploaded a malicious plugin running with app privileges. A mobile app downloaded and executed code updates over HTTP without verification.

A web application deserialized Java objects from user input, triggering remote code execution. Integrity failures cross multiple attack surfaces. Remediation includes secure deserialization, digital signatures, checksum verification, and safer data formats. Severity: high to critical because it often leads to code execution.

A09:2025 Security Logging and Alerting Failures

Incomplete logs, missing security events, unseen alerts, weak retention. An application logged requests but never captured authentication failures. A system was compromised for three months before detection because alerts went to unmonitored emails. A database had logging disabled for performance. Attackers count on logging gaps.

Scanners cannot evaluate logging completeness or alert effectiveness. Manual testing includes reviewing logging architecture, validating alerts, and simulating incidents. Severity: medium to high because failures enable other attacks.

A10:2025 Mishandling of Exceptional Conditions

New in 2025, this covers error handling, fail-open behavior, unvalidated exceptions, and resource exhaustion.

When authentication threw an exception, the handler continued without validating the user. A payment system defaulted to approving transactions when its processor was down. An API endpoint that ran out of disk space returned an error but allowed the request to proceed. Stack traces exposed database credentials. This requires understanding what "safe failure" means for your application. Severity varies, but fail-open conditions often create critical access.

What the Changes Mean for Your Security Program

The OWASP Top 10 should inform design reviews, code review, pentesting, and monitoring. In design reviews, identify which risks your architecture must defend against. During pentesting, confirm each category is tested in your actual application rather than relying on checklists alone. In monitoring, define alerts for attack indicators against these categories.

Prioritize vulnerabilities by application exposure, exploitability, data sensitivity, and business impact rather than treating the OWASP order as universal. A broken access control flaw in your admin tool differs from one in your customer-facing API. A cryptographic failure affecting backup data differs from one affecting OWASP certification requirements or customer passwords.

How Penetration Testing Goes Beyond OWASP Coverage

Your application might check all ten OWASP Top 10 boxes and still be compromised. The OWASP Top 10 is an awareness document that ranks the most common application security risks by prevalence across thousands of applications. A SaaS company prioritizes broken access control OWASP risks differently than a payment processor prioritizes Cryptographic Failures. Scanning for OWASP coverage gives false confidence because scanners excel at detecting common misconfigurations but miss application-specific risks that lead to real breaches. 

When comparing OWASP ZAP vs. Burp Suite for OWASP Top 10 coverage, both tools flag missing security controls. But neither uncovers business logic flaws, authorization nuances, or chained attack paths unique to your system. A scanner reports your password reset exists. It won’t find that the reset token is predictable, unexpired, or reusable.

Manual pentesting validates exploitability, tests business logic, uncovers chained paths, and delivers reproducible evidence your engineers can follow to confirm fixes are real. You get prioritized remediation with business impact context and retesting that proves vulnerabilities are gone.

Frequently Asked Questions

What is the latest OWASP Top 10 version?

The OWASP Top 10:2025 is the current version, finalized in January 2026. This marks the first major update since 2021. The 2025 version uses a combination of contributed application-testing data from practitioners, metrics derived from over 175,000 CVE records, and a community survey to identify and rank the most prevalent risks. This three-part methodology aligns far more closely with current threat landscapes than older editions that relied on a narrower data set.

Is the OWASP Top 10 a penetration testing checklist?

The OWASP Top 10 isn't designed as a pentesting checklist, though many teams use it that way. It's a baseline, but it doesn't provide complete coverage or application-specific analysis. A pentest guided only by OWASP categories will miss business logic flaws and attack paths unique to your application. Real pentesting validates exploitability and demonstrates how modest vulnerabilities chain into critical breaches. The list should inform scope rather than limit it.

Does the OWASP Top 10 apply to APIs?

The OWASP Top 10 for Web Applications applies partially to APIs, but API security has distinct risks. Categories such as Broken Access Control, Injection, and Authentication Failures affect APIs. However, APIs present unique authorization challenges and expose different data structures. For API-specific guidance, reference the OWASP API Security Top 10.