The OWASP Top 10 is the reference list most auditors, regulators and development teams use to talk about web application risk. Its 2025 edition is the first update since 2021, and the changes say a lot about how applications are built and attacked today.

The 2025 list at a glance

  1. A01 Broken Access Control — still number one.
  2. A02 Security Misconfiguration — up from fifth place.
  3. A03 Software Supply Chain Failures — new.
  4. A04 Cryptographic Failures
  5. A05 Injection — down from third place.
  6. A06 Insecure Design
  7. A07 Authentication Failures
  8. A08 Software or Data Integrity Failures
  9. A09 Security Logging and Alerting Failures
  10. A10 Mishandling of Exceptional Conditions — new.

What changed, and why it matters

Access control is still the biggest problem

Broken access control stays at the top. It covers users reaching data or functions they should not, such as changing an ID in a URL to view another customer's record. Server-side request forgery, which had its own category in 2021, is now part of this one.

Misconfiguration moves up

Default credentials, open cloud storage, verbose error messages and unnecessary features left switched on now rank second. As more of an application's behaviour is defined in configuration and cloud settings, mistakes there have become a leading cause of exposure.

Your supply chain is now a top-three risk

Software Supply Chain Failures is a new category at number three. Modern applications are assembled from open-source packages, build tools and third-party services as much as they are written. A vulnerable or malicious dependency, or a compromised build pipeline, can undermine an otherwise well-written application.

Errors need handling, not just logging

Mishandling of Exceptional Conditions, the second new category, covers applications that fail in unsafe ways: crashing into an insecure state, leaking details in error messages, or skipping security checks when something unexpected happens.

Five practical steps

  1. Test authorisation, not just authentication. Check that every request for a record verifies the user is allowed to see it, in your APIs as well as your web pages.
  2. Review configuration as code. Scan infrastructure-as-code and cloud settings for misconfigurations before they reach production.
  3. Know what is in your software. Keep a software bill of materials (SBOM), scan dependencies for known vulnerabilities and verify where your packages and updates come from.
  4. Design for failure. Make sure errors fail closed, show users generic messages and log the detail securely.
  5. Make logging useful. Log security-relevant events and alert on them, so attacks are noticed while they are happening.

How we can help

Our application security team helps organisations in Bahrain and Saudi Arabia find and fix these risks, from code and dependency scanning to penetration testing and web application and API protection. Explore our Application & API Security solutions or talk to our team.