The OWASP Top 10 (2025) Explained
By CyberSecurity.pk · Oct 27, 2026 · updated Oct 27, 2026
What the list is
The OWASP Top 10 is an awareness document built from community data and surveys, updated every few years. It is a starting point, not a complete checklist; for a full standard see OWASP ASVS. This article follows the 2025 edition (A01–A10 as published on owasp.org).
The ten categories
| # | Category | In one line | Typical defence |
|---|---|---|---|
| A01 | Broken Access Control | Users act outside their permissions | Server-side authorisation checks, deny by default |
| A02 | Security Misconfiguration | Insecure defaults, open services, verbose errors | Hardened baselines, config reviews |
| A03 | Software Supply Chain Failures | Compromised or vulnerable dependencies and build pipelines | SBOMs, pinning, dependency scanning, signed builds |
| A04 | Cryptographic Failures | Weak or missing protection of sensitive data | TLS, modern algorithms, proper key management |
| A05 | Injection | Untrusted data interpreted as commands (SQL, OS, LDAP) | Parameterised APIs, input validation |
| A06 | Insecure Design | Missing security in the design itself | Threat modelling, secure design patterns |
| A07 | Authentication Failures | Weak login, session or credential handling | MFA, rate limits, secure session management |
| A08 | Software or Data Integrity Failures | Trusting unverified code or data | Signature verification, safe deserialisation |
| A09 | Security Logging and Alerting Failures | Attacks go unnoticed | Meaningful logs and alerting — see log analysis |
| A10 | Mishandling of Exceptional Conditions | Errors and edge cases leave the system insecure | Fail safely, handle every error path, no information leaks |
How to use it
- Developers: map each category to code review checks and tests.
- Testers: use it to structure an authorised assessment, for example with OWASP ZAP.
- Managers: use it in training and security requirements, not as a compliance pass/fail list.
Previous editions (such as 2021) used different groupings, so check which edition a course or report refers to. Start with web application security fundamentals if the terms are new.
Related tool: OWASP ZAP
Use techniques only on systems you are authorised to test.