The New 2025 OWASP Top Ten
8 days ago
- #Top10
- #OWASP
- #Security
- Introduction to the OWASP Top 10:2025 with new categories and changes.
- A01:2025 - Broken Access Control remains the most serious risk.
- A02:2025 - Security Misconfiguration moves up to #2.
- A03:2025 - Software Supply Chain Failures is a new category.
- A04:2025 - Cryptographic Failures drops to #4.
- A05:2025 - Injection falls to #5 but remains critical.
- A06:2025 - Insecure Design slides to #6.
- A07:2025 - Authentication Failures stays at #7 with a name change.
- A08:2025 - Software or Data Integrity Failures remains at #8.
- A09:2025 - Logging & Alerting Failures stays at #9 with a name change.
- A10:2025 - Mishandling of Exceptional Conditions is a new category.
- Methodology combines data and community survey insights.
- Categories focus on root causes over symptoms.
- Data analysis includes CVSS scores and CWE mappings.
- Community survey highlights underrepresented risks.
- Acknowledgments to data contributors and lead authors.