OWASP Top 10
OWASP · OWASP Top 10:2025 · Open Worldwide Application Security Project · web application security risks · Top 10 OWASP
The reference ranking of the ten most critical categories of web application security risk, published by the OWASP Foundation and used worldwide to raise awareness and set requirements.
In practice
The latest edition is the 2025 one, which replaces the 2021 list: A01 Broken Access Control, A02 Security Misconfiguration, A03 Software Supply Chain Failures, A04 Cryptographic Failures, A05 Injection, A06 Insecure Design, A07 Authentication Failures, A08 Software or Data Integrity Failures, A09 Security Logging and Alerting Failures, A10 Mishandling of Exceptional Conditions. It is an awareness tool, not an exhaustive standard: for detailed verification of an application, OWASP offers the ASVS.
Fictional case: a company commissioning a customer portal writes into the contract that the developer must cover, as a minimum, all ten categories of the OWASP Top 10:2025 and hand over a penetration test report before go-live.
How to protect yourself
- Train developers on the ten categories and how to prevent them.
- Build SAST, DAST and SCA scans into the development pipeline.
- Commission an application penetration test before every major release.
- Require a specific OWASP ASVS level in development contracts.
