OWASP Top 10:2025 is out — the three changes worth reading about

The 2025 list

• A01: Broken Access Control
• A02: Security Misconfiguration
• A03: Software Supply Chain Failures
• A04: Cryptographic Failures
• A05: Injection
• A06: Insecure Design
• A07: Authentication Failures
• A08: Software or Data Integrity Failures
• A09: Security Logging and Alerting Failures
• A10: Mishandling of Exceptional Conditions

Security Misconfiguration moves from fifth to second

A three-place climb reflects something enterprise IT teams already see: systems now have far more settings to get wrong than they used to, across cloud services, containers and the external services wired between them. A great many exposures come not from code that was written incorrectly but from defaults that were never changed, permissions that were left wider than the job needed, or a service that reached the internet by accident.

• Review the defaults of every service you enable; a vendor default is not a promise of the safest setting.
• Check that nothing internal is reachable from outside without a reason.
• Make configuration something that can be checked repeatedly, rather than something an administrator has to remember.

The software supply chain gets its own category

Software Supply Chain Failures widens the 2021 category for vulnerable and outdated components to cover the whole route software takes into a system: not just stale libraries, but the tooling that builds it, the pipeline that ships it and every third-party part along the way. For an organisation that buys more software than it writes, the question this raises is a simple one — do you know what the systems you run are actually made of?

A new entry on handling the unexpected

A10, Mishandling of Exceptional Conditions, is new for this edition and covers 24 weakness patterns around improper error handling: a system that leaks internal detail through an error page, or one that meets a situation it did not anticipate and takes the less safe path rather than stopping.

Getting value out of it

The Top 10 is not a certification checklist. It works best as a shared vocabulary between development, operations and management. The organisations that get the most from it tend to attach it to a process they already run — as headings for code review, or as the starting scope for a penetration test.