OWASP Top 10

The OWASP Top 10:2025 List

1. A01 Broken Access Control. Users can act outside their intended permissions.
2. A02 Security Misconfiguration. Insecure defaults, settings or exposed features.
3. A03 Software Supply Chain Failures. Risks from dependencies, build systems and distribution.
4. A04 Cryptographic Failures. Weak or missing protection of sensitive data.
5. A05 Injection. Untrusted input interpreted as commands or queries.
6. A06 Insecure Design. Missing or flawed security controls at the design level.
7. A07 Authentication Failures. Weaknesses in identity and session handling.
8. A08 Software or Data Integrity Failures. Trusting code or data without verifying it.
9. A09 Security Logging and Alerting Failures. Attacks that go unseen or unanswered.
10. A10 Mishandling of Exceptional Conditions. Errors and edge cases that leave systems in an unsafe state.

What Changed in the 2025 Edition

Broken access control remains the top risk. Software supply chain failures appear as a dedicated category at A03, reflecting how often attacks now arrive through dependencies and build pipelines. Mishandling of exceptional conditions is a new entry at A10.

How Teams Use the OWASP Top 10

The list is a starting point, not a complete standard. Teams use it to train developers, to frame secure code review and to check that their testing covers the most common risk categories. For a full set of verifiable requirements, OWASP points to its Application Security Verification Standard.

Where Scanners Fall Short

Pattern-based tools are good at categories like injection, but the top-ranked risk, broken access control, is often a business logic problem that only shows up when you understand who is allowed to do what. Nullify's code security analysis reasons about how the application actually works to catch authorization failures, IDOR and business logic flaws that signature-based SAST misses. See how Nullify Code Security works.