OWASP Top 10 (2025): The Ten Biggest Risks for Web Applications

What is the OWASP Top 10?

Web applications are a common way in for attackers. The OWASP Top 10 shows where the biggest risks are. It is meant for developers, architects, security teams and software buyers.

The list is not a full test catalog. It helps you set priorities. If you have the ten categories under control, you have covered the most common and most serious flaws.

How is the List Made?

For the 2025 edition, OWASP analyzed data on more than 2.8 million applications. It looked at 589 weakness types from the CWE catalog, a list of typical software flaws. 248 of them are mapped to the ten categories.

Eight categories come from this data. Two more come from a survey of experts. This way, new risks that are still rare in test data are included too.

The OWASP Top 10:2025 at a Glance

1. A01 – Broken Access Control: Users can see or change data they have no rights to. Since 2025, server-side request forgery (SSRF) is part of this category. Protection: check every request on the server, deny by default, grant rights by the principle of least privilege.
2. A02 – Security Misconfiguration: Systems, applications or cloud services are set up in an unsafe way, for example with default passwords or open admin access. Protection: hardened templates, switch off unneeded features, check configuration automatically.
3. A03 – Software Supply Chain Failures: Attackers compromise the libraries, tools or build processes your software is made from. The category is new and widens the earlier topic of outdated components. Read more under supply chain attack. Protection: an inventory of all dependencies, timely updates, checks on where packages come from.
4. A04 – Cryptographic Failures: Data is not encrypted, or only weakly, in transit or at rest. Protection: current methods, TLS for all connections, sound key management. Basics under encryption.
5. A05 – Injection: Unchecked input is run as a command. Examples are SQL injection and cross-site scripting (XSS). Protection: parameterized queries, input checks, correct output encoding.
6. A06 – Insecure Design: The flaw is in the design, not in the code. Protection: think through threats while planning (threat modeling) and use proven security patterns.
7. A07 – Authentication Failures: Attackers can pose as other users, for example through credential stuffing. Protection: multi-factor authentication, protection against automated login attempts, secure session handling.
8. A08 – Software or Data Integrity Failures: Code or data is trusted without checks, for example in updates, CI/CD pipelines or deserialization. Protection: verify signatures, secure build pipelines.
9. A09 – Security Logging and Alerting Failures: Attacks go unnoticed because logs are missing or no one gets alerted. OWASP now puts the stress on alerting. Protection: collect security events centrally and link alerts to clear owners. Read more under security logging and monitoring.
10. A10 – Mishandling of Exceptional Conditions: The application reacts wrongly to errors and exceptions. One example is "failing open": on an error, access is allowed instead of denied. The category is new. Protection: catch errors on purpose, fail safely when in doubt, test error paths.

What Changed Since 2021?

OWASP names two new categories and one merger:

• New: A03 Software Supply Chain Failures and A10 Mishandling of Exceptional Conditions.
• Merged: SSRF was its own category in 2021 (A10). Since 2025, it is part of A01 Broken Access Control.
• Renamed: "Identification and Authentication Failures" became "Authentication Failures". "Security Logging and Monitoring Failures" became "Security Logging and Alerting Failures".
• New order: Security Misconfiguration moves up from 5th to 2nd place. Cryptographic Failures drops from 2nd to 4th, Injection from 3rd to 5th and Insecure Design from 4th to 6th.

How to Put the OWASP Top 10 into Practice

• Start early: Security requirements belong in planning, not only in testing. Read more under secure coding.
• Check automatically: Code analysis and dependency scans run with every build. See DevSecOps.
• Train: Developers should know the ten categories and typical examples.
• Test regularly: A penetration test checks whether the measures work in the running application.
• Patch quickly: Close known flaws in components fast. See patch management.

OWASP Top 10 and Penetration Tests

Many clients require a pentest to cover the OWASP Top 10. That is a good minimum standard. Make sure the test also checks logic and permissions, not just automated scans. A01 and A06 in particular are mostly found by manual testing.

In the SecTepe penetration test, we test web applications by hand based on the OWASP Web Security Testing Guide (WSTG). The OWASP Top 10 is part of the scope, as are business logic, logins and sessions.

Conclusion

The OWASP Top 10:2025 shows where web applications are most often vulnerable. The new focus is on the software supply chain and on how errors are handled. If you build the ten categories into planning, development and testing, you lower your risk a great deal.