What Changed in the OWASP Top 10:2025
The OWASP Top 10 is not a ranking of individual vulnerabilities but a grouping of related weaknesses into ten risk categories. For the 2025 edition the OWASP Foundation analysed one of its largest datasets yet: around 175,000 CVE records fed into the analysis, and each of the ten categories maps to concrete weakness classes - 248 CWEs in total (OWASP Foundation). These CWE references come from MITRE's Common Weakness Enumeration, a catalogue that now contains more than 940 documented weakness classes (MITRE Common Weakness Enumeration). Familiar entries such as CWE-79 for cross-site scripting or CWE-89 for SQL injection show how the abstract OWASP categories connect to concrete, nameable flaws (MITRE Common Weakness Enumeration).
The changes from the 2021 edition are pronounced. Broken Access Control stays at the top and now additionally absorbs Server-Side Request Forgery. Security Misconfiguration jumps from fifth to second - misconfigurations became noticeably more prevalent in this cycle's data (OWASP Foundation). Behind them sit two brand-new categories, while established topics such as Cryptographic Failures (from second to fourth) and Injection (from third to fifth) move down the ranking. The overview below places the ten categories and their movement in context.
| 2025 | Category | Change vs. 2021 |
|---|---|---|
| A01 | Broken Access Control | unchanged, rank 1; SSRF merged in |
| A02 | Security Misconfiguration | up from rank 5 |
| A03 | Software Supply Chain Failures | new |
| A04 | Cryptographic Failures | down from rank 2 |
| A05 | Injection | down from rank 3 |
| A06 | Insecure Design | down from rank 4 |
| A07 | Authentication Failures | rank 7; renamed |
| A08 | Software or Data Integrity Failures | unchanged, rank 8 |
| A09 | Security Logging and Alerting Failures | rank 9; renamed |
| A10 | Mishandling of Exceptional Conditions | new |
A category dropping in the ranking does not mean its risk falls - only its relative weight in the data shifts. Injection, for instance, still covers classics such as SQL injection and cross-site scripting, which was folded into this category in the 2021 edition. Two renamings sharpen the focus: "Identification and Authentication Failures" becomes simply Authentication Failures, and "Security Logging and Monitoring Failures" is now Security Logging and Alerting Failures - the emphasis moves from mere recording to actual alerting (OWASP Foundation). For the everyday work of website operators, three movements matter most, and this guide explores them next: the new supply-chain category, the rise of misconfiguration, and the new category around error handling.
A03 Software Supply Chain Failures: The New Core Risk
The most striking addition is A03 Software Supply Chain Failures. The category did not appear out of nowhere: it traces back to "Using Components with Known Vulnerabilities", which appeared on the list as early as 2013 and was carried in 2021 as "Vulnerable and Outdated Components". In the 2025 edition, however, the lens is considerably wider and now embraces all kinds of supply-chain failures - not only known flaws in libraries but also compromised build processes, tampered dependencies and slipped-in updates (OWASP Foundation). The data is notable: A03 shows the highest prevalence of the entire list with an average incidence rate of 5.72 percent, even though only a handful of CVE records map to its associated CWEs (OWASP Foundation). That gap is the real point: supply-chain attacks are already happening in practice while classic vulnerability scanners often lack signatures for them.
97 percent of all examined codebases contain open source, on average 981 open-source components per application, and 86 percent of commercial codebases carry at least one vulnerable open-source component (Black Duck OSSRA 2025). In parallel, the supply-chain attack surface has had real-world impact: in the Verizon Data Breach Investigations Report 2025 the share of breaches involving a third party doubled to 30 percent (Verizon DBIR 2025), and in the ENISA Threat Landscape 2025 software supply-chain attacks account for roughly 10.6 percent of analysed incidents, placing them among the ten most important threat categories (ENISA Threat Landscape 2025).
For websites the supply chain has a very concrete face: embedded third-party scripts. Payment widgets, consent banners, chat tools or analytics snippets load foreign code straight into the visitor's browser - and a secretly altered script is the classic Magecart pattern in which attackers skim card data. Anyone who knows their embedded scripts and monitors their fingerprint spots such tampering earlier; how this works is described in the article on monitoring Subresource Integrity. The substantive basis - a current inventory of all components in use - is provided by a software bill of materials, as the guide to the SBOM under the Cyber Resilience Act explains in detail. A03 turns that inventory from a nice-to-have into a must.
A02 Security Misconfiguration: From Fifth to Second
The second big climber is A02 Security Misconfiguration. The category rose from fifth to second and, in this cycle's data, affected around 3.00 percent of tested applications across its 16 mapped CWEs (OWASP Foundation). Misconfiguration is treacherous because it rarely lies in the code but in default settings, forgotten switches and inconsistent delivery: a missing security header, an overly open permission, an enabled debug directory, a default error page that reveals too much. Precisely because these flaws sit on the configuration surface, they are especially visible from the outside - and therefore continuously checkable.
The HSTS header enforces HTTPS and protects against downgrade attacks. If it is missing or the max-age is too short, a gap in transport stays open.
A CSP limits which sources may load scripts and styles - one of the most effective brakes on cross-site scripting, as the article on CSP configuration shows.
These directives prevent the page from being embedded in foreign frames without consent - protection against clickjacking. Their absence is a typical misconfiguration.
Headers such as Referrer-Policy or X-Content-Type-Options are quick to set but easy to forget. Which headers matter is laid out in the article on HTTP security headers.
A cleanly set header today is not automatically still there after the next deploy, the next server migration or the next plugin update. Misconfiguration rarely arises on purpose; it creeps in over time. A one-off check therefore only delivers a snapshot; only a recurring control catches the drift before it becomes a gap.
A10 Mishandling of Exceptional Conditions: When Error Handling Becomes a Gap
The second new category, A10 Mishandling of Exceptional Conditions, addresses an often underrated area: how errors and exceptional situations are handled. It bundles more than two dozen weakness classes around unclean error handling (OWASP Foundation). The problem is rarely the normal case but the edge case: what happens when an input fails unexpectedly, a service does not respond or a condition arises that no one anticipated? Does it then abort safely - or does a door quietly open?
- Error pages that reveal too much - a stack trace or a database error on a 500 page gives attackers hints about the internal structure
- "Fail open" instead of "fail closed" - if a check waves things through on error rather than blocking, the exception itself becomes a weakness
- Incomplete recovery - a half-aborted operation leaves data in an inconsistent state
- Inconsistent exception handling - the same error class leads to different behaviour in different places and thus to hard-to-predict reactions
Security is often decided not in normal operation but in the exceptional case. An application that reacts cleanly and predictably on failure closes exactly the doors that careless error handling leaves open.
— Paraphrased from OWASP Top 10:2025, A10 Mishandling of Exceptional Conditions
For website operators, A10 is partly visible from the outside: how does a page behave under an invalid request? Does the 404 or 500 page show technical internals? Does an error message leak server versions, paths or framework details? These observations are no substitute for clean error handling in the code, but they are a valuable early-warning signal - and they can be checked from the outside repeatedly.
A01 Broken Access Control and the Relocation of SSRF
Broken Access Control defends the top spot on the list: on average 3.73 percent of tested applications exhibited at least one of the 40 mapped weakness classes (OWASP Foundation). Access control means every user may only see and do what they are authorised to - and violations range from manipulable URLs through missing server checks to privilege escalation. The category stays on top because it has so many facets and because a single flaw can have far-reaching consequences.
The most interesting substantive shift is the relocation of Server-Side Request Forgery into this category. In the 2021 edition SSRF was a standalone position (A10:2021); in 2025 it is understood as a special case of access control (OWASP Foundation). The logic: with SSRF, a server is coerced into making requests it should not be allowed to make - for example to internal services or metadata endpoints. At its core, that is a control problem. Related is a common website misconfiguration: overly permissive CORS rules that grant foreign origin sites more access than necessary. How to check and monitor such rules is shown in the article on CORS configuration and its pitfalls.
From OWASP Categories to Observable Signals
A risk list is valuable, but at first it is abstract. The practical step is to translate the categories into observable signals - features that can be checked repeatedly from the outside against a website's actually delivered state. Not every OWASP category is externally visible; Insecure Design, for example, is a question of architecture and cannot be judged by a header check. Yet the three big movements of the 2025 edition - misconfiguration, supply chain and error handling - leave traces you can measure.
| OWASP category 2025 | Observable signal | Continuously checkable |
|---|---|---|
| A02 Security Misconfiguration | Missing or faulty security headers, open directories, outdated TLS versions | Header and TLS check |
| A03 Software Supply Chain Failures | New or altered third-party scripts, missing SRI hashes, dependency drift | Script integrity monitoring |
| A01 Broken Access Control | Overly permissive CORS rules, exposed or unintentionally reachable endpoints | CORS and endpoint check |
| A08 Data Integrity Failures | Altered delivery, unexpected content change of a page | Delivery and defacement comparison |
| A10 Mishandling of Exceptional Conditions | Error pages with stack traces, telltale 500 behaviour | Behaviour of error pages |
The value of this translation lies in repeatability. A security check that runs once a year through an external provider sees the state on exactly one day. But the three climbers of the OWASP Top 10:2025 have in common that they drift: headers disappear after a deploy, a new third-party script slips into the consent banner, an error page changes its behaviour after a framework update. That is exactly why continuous observation is the fitting response mode - not as a substitute for secure development but as its ongoing control.
Check Continuously Instead of Once
This is exactly where the XICTRAQ security scan comes in. It checks a website's externally visible security features at regular intervals and thereby covers above all the misconfiguration- and supply-chain-related categories of the OWASP Top 10:2025 - those areas that can be measured against the actually delivered state. The abstract list thus becomes a recurring workflow with clear signals.
Security headers, HTTPS enforcement and protocol versions are checked and rated - the central signals around A02 Security Misconfiguration.
The script integrity monitoring continuously compares the fingerprint of embedded foreign scripts and flags drift - a direct signal for A03 Software Supply Chain Failures.
Unexpected changes to delivered content are detected, as described in the article on defacement attacks - relevant to integrity failures.
Deviations flow into the same notification workflow as the rest of the monitoring - by email, Slack, Discord or Telegram, with escalation.
The scan does not stand alone but complements the rest of the attack-surface observation into a picture of the actually delivered state - not just the intention. Anyone wanting to know which tier fits their requirements will find the details in the pricing overview. One qualification remains important: an external scan replaces neither secure development nor legal or security advice. It does, however, shorten the time in which a misconfiguration or an altered third-party script goes unnoticed - and in day-to-day operations that is often the decisive difference.
Putting the OWASP Top 10:2025 into Practice Now
The OWASP Top 10:2025 is not an academic document but a map of the risks attackers actually orient themselves by today. For website operators a pragmatic three-step approach pays off: mirror your own website against the list, translate the externally visible categories into measurable signals, and then observe those signals continuously rather than once. In particular the three movements of the new edition - the rise of misconfiguration, the new supply-chain category and the new category on error handling - can be moved from concept to operation this way.
The OWASP topics reach over into neighbouring obligations. Anyone handling card data will find in client-side protection under the payment standard a close link to A03 and A06, as the article on PCI DSS 4.0.1 client-side security shows. And anyone thinking about brand trust and email security together will find in the article on BIMI and VMC authentication for brand logos a further building block of a credible security posture. A live demo shows what continuous security observation looks like in practice; getting started works via the free registration.
This article draws on data and documents from: OWASP Foundation (OWASP Top 10:2025 - unveiled November 2025 at OWASP Global AppSec, finalised January 2026; basis of around 175,000 CVE records and 248 CWEs mapped to the categories; ranking A01 to A10; two new categories A03 Software Supply Chain Failures and A10 Mishandling of Exceptional Conditions; Security Misconfiguration from rank 5 to rank 2; SSRF merged into Broken Access Control; A01 3.73 percent, A02 3.00 percent, A03 average incidence rate 5.72 percent; renamings of A07 and A09), MITRE Common Weakness Enumeration (CWE catalogue with more than 940 weakness classes, CWE-79 cross-site scripting, CWE-89 SQL injection), Black Duck Open Source Security and Risk Analysis Report 2025 (open-source share, vulnerable components, components per application), Verizon Data Breach Investigations Report 2025 (doubling of third-party involvement in breaches to 30 percent), ENISA Threat Landscape 2025 (share of supply-chain attacks). This is not legal or security advice.