Starting with the OWASP Top 10:2025

For tonight's PWPA studies, I followed up on the links recommended in the previous session on Web Application Security Standards and Best Practices. I started with the OWASP Top 10.

There is a lot to take in. Alongside the ten category names are explanations, examples, prevention guidance, Common Weakness Enumerations, and references for further reading. I am turning my notes into a series so that each topic has room for a closer look.

This first post covers the overall list and the changes in the 2025 edition. The next four posts follow the categories I covered in more detail: Broken Access Control, Security Misconfiguration, Software Supply Chain Failures, and Cryptographic Failures.

What is OWASP?

The Open Worldwide Application Security Project, or OWASP, is a community focused on improving application security. Its resources include tools, testing guidance, standards, and cheat sheets.

The OWASP Top 10 is an awareness document about major web application security risks. It gives developers and people studying application security a shared starting point.

For more specific work, OWASP also provides resources such as the Web Security Testing Guide, the Application Security Verification Standard, and the Cheat Sheet Series. Those resources help connect a broad risk category to requirements, testing, and implementation details.

The 2025 list

A01: Broken Access Control
A02: Security Misconfiguration
A03: Software Supply Chain Failures
A04: Cryptographic Failures
A05: Injection
A06: Insecure Design
A07: Authentication Failures
A08: Software or Data Integrity Failures
A09: Security Logging & Alerting Failures
A10: Mishandling of Exceptional Conditions

The numbers identify the categories and their positions in this edition. They do not tell us exactly which issue will cause the most harm in a particular application.

What changed from 2021?

Broken Access Control remains at number one. Server-Side Request Forgery, which had its own category in 2021, is included within it in 2025.

Security Misconfiguration moves from fifth to second. Software Supply Chain Failures broadens the earlier category of Vulnerable and Outdated Components to cover more of the software development and delivery process.

Mishandling of Exceptional Conditions is a new category. It brings attention to how applications behave when something goes wrong, including errors, unexpected states, and failures that allow access rather than blocking it.

There are also naming changes. Authentication Failures has a shorter name, while Security Logging & Alerting Failures explicitly calls out alerting. Recording a security event is useful, but someone or something also needs to recognize when it requires action.

How I am organizing the reading

The category names are a useful starting point, but the questions underneath them make the material easier to connect:

Who is allowed to access a resource or perform an action?
Which settings affect how safely an application runs?
What code and tools does the application depend on?
What data needs protection, and how are the keys handled?

These questions are relevant at different points in an application's life. Some concern design, some concern implementation, and others concern deployment and maintenance.

The application’s purpose also matters. A public event listing and a system holding private customer records may use similar software while having very different consequences if information is exposed. A useful review needs to consider the data, users, exposure, and business impact as well as the category name.

Where I am starting

The first four categories provide a manageable place to begin this series. For each one, I will work through the basic problem, a simple example, and the prevention ideas from my reading.

The Top 10 gives me a structure for the study notes. The linked OWASP guidance provides the detail to keep exploring each subject.

Sources and further reading