OWASP Top 10:2025 – what changed and what CISOs should ask for
The OWASP Top 10 is the best-known list of web application security risks. It shapes vendor contracts, penetration test scopes and developer training. The 2025 edition replaces the 2021 list and reflects how software is built today.
The 2025 list
| Rank | Category | In one sentence |
|---|---|---|
| A01 | Broken Access Control | Users reach data or actions that aren't theirs |
| A02 | Security Misconfiguration | Defaults, open cloud permissions, missing security headers |
| A03 | Software Supply Chain Failures | Risk from dependencies, build tools, CI/CD and vendors |
| A04 | Cryptographic Failures | Weak, missing or mismanaged cryptography |
| A05 | Injection | SQL injection, XSS, command injection |
| A06 | Insecure Design | Flaws in the design that no patch will fix |
| A07 | Authentication Failures | Weak passwords, no MFA, poor session handling |
| A08 | Software or Data Integrity Failures | Updates or data used without verifying integrity |
| A09 | Security Logging and Alerting Failures | No logs, or logs nobody is alerted on |
| A10 | Mishandling of Exceptional Conditions | Poor error handling and edge cases, such as failing open |
Three changes worth noticing
- Supply chain moved up to #3. "Vulnerable components" grew into the whole supply chain: open-source packages, build pipelines, CI/CD permissions and code signing.
- Misconfiguration moved up to #2. As more of the stack becomes configuration (cloud, containers, IaC), more incidents start as configuration mistakes.
- A new category for exceptional conditions: systems that fail open, or leak sensitive data in error messages.
What to require from teams and vendors
- Server-side authorization checks on every request, with automated tests for IDOR.
- An SBOM and dependency scanning on every build.
- MFA on all admin interfaces and on development systems (Git, CI, cloud).
- Security headers (CSP, HSTS) and configuration checks as part of deployment.
- Centralized logging with real alerting, not just log storage.
- In vendor contracts: a pen test against the OWASP Top 10 and defined remediation SLAs.
Official source: OWASP Top 10 (opens in a new window)