OWASP Top 10 Rewritten, Security Playbooks Out of Date
Introduction
Every few years the OWASP Top 10 gets refreshed to reflect how software is built and attacked in the real world. The 2025 update, resulting in a modern OWASP Top 10, is the biggest shift in more than a decade. It moves the focus away from old, code-centric thinking and toward the broader systems, supply chains, and architectures that shape modern applications.
Today most teams work with cloud services, containers, CI systems, open source libraries, and automated pipelines. This creates speed, but it also creates risk. The new Top 10 acknowledges that reality. It is less about spotting one bug in a single function and more about understanding everything that surrounds an application after the code is written.
What rewritten list looks like
Here is the full, modern OWASP Top 10 2025 list with new categories and reordered priorities:
| Rank | Risk (2025) |
|---|---|
| A01:2025 Broken Access Control | Remains #1 — still the most prevalent and dangerous class of risk. (Endor Labs) |
| A02:2025 Security Misconfiguration | Climbed from #5 in 2021 to #2, reflecting rising incidents tied to mis-set permissions, exposed secrets, cloud misconfigurations and defaults. (OWASP Foundation) |
| A03:2025 Software Supply Chain Failures | Newly introduced risk that jumps to #3 — expanding the previous “Vulnerable and Outdated Components” category into a broader supply-chain scope. (Endor Labs) |
| A04:2025 Cryptographic Failures | Falls to #4, partly due to improved adoption of secure defaults and better encryption practices. (Endor Labs) |
| A05:2025 Injection | Drops to #5, a significant shift from prior editions where injection vulnerabilities (SQL, XSS, etc.) were often near the top. (Endor Labs) |
| A06:2025 Insecure Design | Moved down from earlier rank — reflecting progress in secure-by-design practices, threat modeling, and architecture hygiene. (Endor Labs) |
| A07:2025 Authentication Failures | Name slightly changed (from “Identification and Authentication Failures”) and shifted down — still critical, but comparatively less dominant. (Endor Labs) |
| A08:2025 Software and Data Integrity Failures | Maintains its place — continuing to draw attention to problems where data integrity is compromised, e.g. via malicious or faulty components. (Endor Labs) |
| A09:2025 Logging & Alerting Failures | Also maintained — expanded from prior “Security Logging & Monitoring Failures”, reflecting the ongoing need for observability and detection. (OWASP Foundation) |
| A10:2025 Mishandling of Exceptional Conditions | A brand-new category replacing the old “Server-Side Request Forgery (SSRF)”. Highlights risks around error-handling, unexpected states, failing-open logic, and other runtime surprises. (OWASP Foundation) |
A Shift Toward Systemic Risk
The biggest headline is the rise of Software Supply Chain Failures. It debuts at number three and covers a wide set of problems that stretch across source code, build pipelines, dependencies, container images, and everything in between. This is more than vulnerable libraries. It includes malicious packages, compromised images, unsafe build steps, and unverified artifacts. In short, all the things that live outside the code you write but run inside your systems.
This change reflects how real incidents happen today. When attackers hit the Log4J vulnerability, they were not targeting a developer’s code. They targeted a component used by thousands of projects. Supply chain weaknesses give attackers wide reach with little effort, and OWASP is now treating that as a top tier risk.
Security Misconfiguration has also climbed to number two. Modern infrastructure is flexible but unforgiving. One wrong setting on a cloud service, one exposed dashboard, one role with too many permissions, and attackers can walk in. Misconfigurations often slip in because teams move fast, rely on defaults, or assume something is secure when it is not. The new ranking pushes teams to treat configuration as seriously as coding.
Another new category is Mishandling of Exceptional Conditions at number ten. This highlights problems that arise when applications fail in unpredictable ways. Examples include unhandled exceptions, unstable states, broken input validation, or logic that fails open instead of safe. These issues often hide under normal conditions but can become critical under load or during unexpected sequences of events.
Why Some Classic Risks Moved Down
Injection and Cryptographic Failures are still dangerous, but they drop lower in the list. This does not mean the risks have vanished. Instead it reflects progress. Frameworks come with safer defaults, teams use prepared statements by default, and encryption is easier to get right. Even so, these issues remain in the Top 5 because old vulnerabilities persist and new injection paths continue to be discovered.
Insecure Design and Authentication Failures also move down, not because they are solved, but because other problems have become more pressing. Many teams now use secure-by-design patterns and rely on strong identity providers, but weaknesses still exist in legacy systems and rushed projects.
The Bigger Message: Security Is Now a Lifecycle Problem
The updated Top 10 paints a clear picture. Security no longer begins and ends at the code editor. It spans design choices, architecture patterns, third-party dependencies, deployment processes, infrastructure configuration, and runtime behavior.
If an organization wants to reduce risk, it has to think about all of these parts working together. This means:
- Using supply chain tools that track dependencies, container images, and transitive libraries.
- Treating configuration as a discipline with defined baselines and regular reviews.
- Building secure designs before writing code, not after.
- Hardening error handling so the system behaves safely under stress.
- Ensuring logging, monitoring, and alerting are strong enough to catch problems early.
This is the key difference between earlier editions and the modern OWASP Top 10 2025 version. The new list treats security as an ecosystem problem. A vulnerable component, a weak build step, or a misconfigured cloud permission can be just as dangerous as a bad line of code.
The Path Forward
The modernized OWASP Top 10 shows how much web development has changed. It is a reminder that today’s applications are assembled from pieces rather than built from scratch. They depend on trust, verification, and careful handling of everything upstream and downstream.
Teams that adapt to this mindset will write safer software and spot weaknesses earlier. Those that keep thinking in old patterns will continue to be surprised by failures that never show up in a static scan.
