OWASP Top 10 Changes
Hi, I’m Mike Broomfield, an experienced cybersecurity leader with around 20 years of hands-on experience spanning consultancies, global financial institutions, and large-scale enterprises. My career has taken me from penetration testing and security architecture roles at leading consultancies and major banks to my current position as Head of Application Security & Security Testing at Tesco. I have a deep passion for security research and engineering innovation, with a focus on embedding security seamlessly into modern software delivery. Over the years, I’ve led initiatives that integrate security into CI/CD pipelines, automate developer guardrails, and strengthen the resilience of complex, cloud-native systems. My approach blends a developer-first mindset with a curiosity for how systems fail and how they can be built stronger.
The Open Worldwide Application Security Project (OWASP) is a global non-profit organization focused on making software security visible so that individuals and organizations can make informed risk decisions. It operates on the principles of community-driven, open-source knowledge sharing. The OWASP Top 10 is the organization’s flagship awareness tool. Its purpose is to identify the ten most critical security risks to web applications. This document is not a static list of vulnerabilities but a living, evolving consensus of the most critical security risks facing web applications.
The latest update, announced as a Release Candidate (RC1) in November 2025, introduces significant changes aligned with today’s software reality. While this RC is not yet final, OWASP has confirmed that only minor refinements are expected before publication. What follows is an overview of the updates in the OWASP Top 10:2025 and how these changes reflect today’s threat landscape.
The 2021 list focused on well-understood issues like Broken Access Control and Cryptographic Failures, setting a baseline for security programs. While these items remain the list now emphasizes systemic and ecosystem-level risks. This evolution signals that application security is no longer just about fixing bugs, it’s about safeguarding the entire software lifecycle
Comparing the 2021 and 2025 iterations highlights how the industry’s focus has adapted to current threat models. The evolution points toward a necessary shift from fixing symptoms to addressing systemic weaknesses.
Key changes
Software Supply Chain Failures (new) – This category addresses risks in dependencies, CI/CD pipelines, and build integrity. Attackers increasingly exploit weak links in the software supply chain, making early detection and continuous monitoring essential.
Mishandling of Exceptional Conditions (new) – Poor error handling and resilience gaps create opportunities for denial of service and data exposure. This addition highlights the need for secure failure modes and robust operational stability.
Security Misconfiguration jumps to #2 – Misconfigurations in cloud and container environments are now among the most critical risks. Their prevalence and impact demand automated assurance and policy-as-code approaches.
SRF merged into Broken Access Control, and Vulnerable Components replaced by broader supply chain coverage – These changes consolidate related risks and expand the focus beyond outdated components to systemic supply chain threats.
The OWASP Top 10 2025 makes three things clear. Software supply chain security is now critical. Error handling is a security control. And foundational vulnerabilities persist. The evolution from the 2021 to the 2025 OWASP Top 10 reflects an application security discipline that is maturing beyond chasing code bugs. It signals a necessary transition where security must be an integrated part of the software architecture and operational model, especially considering the complexity introduced by cloud, APIs, and the global software supply chain.
What Security Programs Should Change
First, security programs must expand beyond application boundaries and treat the software supply chain as a first-class attack surface. This means moving from ad-hoc dependency scanning to continuous verification of build integrity, provenance, and deployment pipelines. SBOM generation, artifact signing, and pipeline access controls should become standard practices rather than advanced maturity goals.
Second, resilience must be treated as a security outcome, not just an availability concern. The addition of exceptional condition handling highlights the need to design systems that fail safely. Security teams should partner more closely with platform and reliability engineers to ensure graceful degradation, rate limiting, circuit breakers, and defensive error handling are built into application architectures from the start.
Third, configuration management must become automated and enforceable at scale. The rise of Security Misconfiguration reflects the reality of cloud-native environments where manual review does not scale. Policy-as-code, infrastructure scanning, and continuous compliance monitoring are now essential controls. Security programs should focus on preventing insecure states from being deployed rather than detecting them after exposure.
Finally, security programs should shift from vulnerability volume metrics toward risk-driven prioritization. With increasingly complex environments, success is no longer measured by the number of issues closed, but by reducing meaningful attack paths and business impact. This requires better asset visibility, contextual risk scoring, and tighter alignment between security, engineering, and business stakeholders.
Taken together, the 2025 Top 10 reinforces a clear message: modern application security is less about finding individual flaws and more about engineering secure systems. Programs that adapt to this mindset will be better positioned to handle the scale, speed, and complexity of modern software delivery.
