OWASP Top 10

What is the OWASP Top 10?

The OWASP Top 10 is a list of the ten most critical security risks to web applications, published by the OWASP Foundation, a nonprofit open community. OWASP calls it “a standard awareness document”: it is meant to get developers, testers and managers talking about the same risks, and to point them towards fixing them.

The current list is OWASP Top 10:2025, the eighth edition since the first in 2003. It replaced the 2021 list.

What is on the 2025 list?

1. A01 Broken Access Control: users acting outside their permissions. It now also covers server-side request forgery (SSRF).
2. A02 Security Misconfiguration: insecure defaults, open settings and unhardened systems, up from fifth place.
3. A03 Software Supply Chain Failures: weaknesses in the components, build systems and distribution behind an application. It widens 2021’s “vulnerable and outdated components”.
4. A04 Cryptographic Failures: weak or missing protection for data in transit and at rest.
5. A05 Injection: untrusted input run as a command or query, including SQL injection and cross-site scripting.
6. A06 Insecure Design: flaws in the design itself, which no amount of careful coding can fix.
7. A07 Authentication Failures: weaknesses in how users prove who they are.
8. A08 Software or Data Integrity Failures: trusting code, updates or data without checking they haven’t been tampered with.
9. A09 Security Logging and Alerting Failures: not recording, or not acting on, what attackers do.
10. A10 Mishandling of Exceptional Conditions: new in 2025. Poor error handling, logic errors and systems that “fail open”.

How is it compiled?

OWASP collects testing data contributed by organisations, covering more than 2.8 million applications for this edition, and groups the weaknesses found into categories. Eight categories come from that data. Two come from a community survey of practitioners, so that risks which testing tools struggle to measure still get a place. OWASP describes the result as data-informed, not blindly data-driven.

How should you use it?

• Training and awareness: it is a good syllabus for developer security training.
• Design and code review: as a checklist of risk areas to think about.
• Choosing tools and testers: ask how they cover each category.

For anything you need to test or contract against, use OWASP’s Application Security Verification Standard (ASVS) instead, currently at version 5.0.0. ASVS sets out detailed, testable requirements; the Top 10 only names the risk areas. Saying an application is “OWASP Top 10 compliant” means little, because the list contains no requirements to comply with.

Where does it appear in compliance?

Other frameworks lean on it for secure development. PCI DSS, for example, expects software to be developed with common coding vulnerabilities in mind and points to industry lists such as OWASP’s. Security questionnaires often ask whether developers are trained on the OWASP Top 10, and penetration test reports commonly classify findings by its categories.