The OWASP Top 10 is the list most security teams, auditors and client questionnaires point to. The 2025 edition changed more than the order. If you run a web app, three of the changes point at work you may need to schedule.
The 2025 list
- Broken Access Control
- Security Misconfiguration
- Software Supply Chain Failures
- Cryptographic Failures
- Injection
- Insecure Design
- Authentication Failures
- Software or Data Integrity Failures
- Security Logging and Alerting Failures
- Mishandling of Exceptional Conditions
Broken access control stays at the top. Server-side request forgery (SSRF), which had its own slot in 2021, now counts as part of it.
Change 1: supply chain failures are now number three
The 2021 list had "Vulnerable and Outdated Components". The 2025 category is broader. It covers compromised dependencies, build systems and the infrastructure that distributes packages. An outdated library is one problem. A package that an attacker took over and republished is another, and your scanner won't flag it as "outdated" because it's the newest version.
What to do about it:
- Commit your lockfile and install with
npm ci(or your language's equivalent) in CI so builds use exact versions. - Review dependency updates as code changes, with a human reading the diff for anything that runs at install time.
- Give CI tokens the least access they need. A build job that can publish packages is a target.
A practical response to the Shai-Hulud npm worm in September 2025.
Change 2: mishandling exceptional conditions is new
This category covers what your app does when something goes wrong: an unexpected null, a timeout from a payment provider, a malformed upload. Apps fail open more often than you'd think. A try/catch that swallows an authorisation error and carries on is an access control bug that no one designed.
Patterns we look for in review:
- Error handlers that log and continue in code paths that check permissions or money
- Stack traces or SQL errors returned to the browser
- Retries without limits that let one bad request hammer a third-party API
The fix is usually small. Fail closed, return a generic message to the user and log the detail on the server.
Change 3: logging now includes alerting
"Security Logging and Monitoring Failures" became "Security Logging and Alerting Failures". Having logs isn't enough if nobody sees the alert. When we set up monitoring for clients, we route a short list of security events (repeated failed logins, admin role changes, bulk exports) to a channel a person reads, and we test the alert once before launch.
What stayed the same
Injection dropped to fifth but hasn't gone away. Cryptographic failures still mostly mean weak password hashing and data sent without TLS. Insecure design still means the threat model never existed. If your last review used the 2021 list, most of its findings still apply.
A practical next step
Take the three changes above and turn them into three checks: lockfile and CI token review, a search for swallowed exceptions in auth and payment code, and one test alert. That's a day of work for most apps and it closes the gaps the new list highlights.
Sources: OWASP Top 10:2025, Introduction to the 2025 edition.
