The OWASP Top 10 is the most widely used reference for web application risk. The 2025 edition reflects how attacks have shifted: fewer simple injection bugs, more failures in the software supply chain, configuration and access control.
What has changed
- Broken access control remains number one. Missing authorisation checks on APIs are still the most common serious finding in our penetration tests.
- Software supply-chain failures now have their own category, covering vulnerable dependencies, compromised build pipelines and unsigned artefacts.
- Security misconfiguration has climbed, driven by complex cloud environments and default settings left unchanged.
- Mishandling of exceptional conditions recognises that error handling and fail-open logic are a real source of breaches.
A practical checklist
- Enforce authorisation on every API endpoint, server-side, with deny-by-default rules.
- Generate a software bill of materials (SBOM) and scan dependencies on every build.
- Scan for secrets before every commit — no credential should ever live in a repository.
- Set security headers everywhere: HSTS, Content Security Policy,
X-Content-Type-OptionsandReferrer-Policy. - Mark session cookies
HttpOnly,SecureandSameSite=Strict. - Test against the OWASP ASVS, not just the Top 10, for systems that handle personal or payment data.
How we can help
Our OWASP security testing service combines manual penetration testing with secure code review and pipeline automation, and every engagement includes a free re-test of the issues you fix.
