The OWASP Top 10 is the most widely cited list of web application security risks, and the 2025 edition draws on data covering more than 2.8 million applications. Founders do not need to know every weakness behind it, but they do need to know which risks sit in their product and who owns the fixes. This guide explains each 2025 category in plain language and turns the list into a fix order.
What the OWASP Top 10 is and why founders should care
The OWASP Top 10 is a ranked awareness list published by the OWASP Foundation, an open community. It groups common software weaknesses (CWEs) into ten categories. For the 2025 edition, OWASP worked with a dataset of 589 CWEs; the ten categories together contain 248 of them. The data came from 13 named organisations plus anonymous donors, and around 220,000 CVEs were extracted for analysis.
For a founder, the list is useful because customers, auditors and enterprise security questionnaires refer to it constantly. Saying that your team tests against the OWASP Top 10 is a common baseline expectation, and being able to explain how is a sales asset as much as a technical one.
The 2025 list at a glance
The table below sets out the ten categories, what each means in plain words, and how its position changed from the 2021 edition. Two categories, Software Supply Chain Failures and Security Logging and Alerting Failures, were chosen through the community survey rather than purely from the data.
| Rank | Category | Plain-English meaning | Change from 2021 |
|---|---|---|---|
| A01 | Broken Access Control | Users can see or change data that is not theirs | Still first; SSRF now folded in |
| A02 | Security Misconfiguration | Unsafe defaults, open storage, verbose errors | Up from fifth |
| A03 | Software Supply Chain Failures | Risky libraries, build tools and third-party code | Expanded from Vulnerable and Outdated Components |
| A04 | Cryptographic Failures | Weak or missing encryption of sensitive data | Down from second |
| A05 | Injection | Untrusted input runs as code or queries | Down from third |
| A06 | Insecure Design | Flaws baked into how a feature works | Down from fourth |
| A07 | Authentication Failures | Weak login, session or password handling | Same rank, renamed |
| A08 | Software or Data Integrity Failures | Unverified updates, data or pipelines | Same rank |
| A09 | Security Logging and Alerting Failures | Attacks happen and nobody is told | Same rank, renamed |
| A10 | Mishandling of Exceptional Conditions | Errors and edge cases fail in unsafe ways | New in 2025 |
Access control and misconfiguration: the top two
Broken access control stays at number one. In a SaaS product this usually means a user changes an ID in a URL or API call and sees another customer's invoice, or a normal user reaches an admin function. The fix is not a tool; it is a rule that every request checks who the caller is and what they may touch, enforced on the server, with tests that try to cross tenant boundaries.
Security misconfiguration rose to second place. Typical examples are public storage buckets, default admin credentials, debug pages left on in production and error messages that reveal stack traces. Infrastructure as code, a short hardening checklist for every new environment and periodic configuration reviews close most of these gaps.
Supply chain and integrity: the risks outside your own code
A03 widens the old outdated-components category to cover the whole chain that builds and ships your software: open-source packages, build tools, CI services and third-party actions. A real example came in March 2025, when CISA warned that the widely used GitHub Action tj-actions/changed-files had been compromised in a way that could expose access keys, tokens and private keys. CISA added it to its Known Exploited Vulnerabilities Catalog.
Founders should ask three questions: do we know which dependencies we ship, are they updated on a schedule, and are pipeline secrets scoped and rotatable. GitGuardian found 23.8 million secrets leaked on public GitHub in 2024, so this category and credential hygiene go together.
Injection, cryptography, design and authentication
Injection fell to fifth, largely because modern frameworks escape queries and output by default, but it has not disappeared. Cryptographic failures cover data sent or stored without proper encryption. Insecure design is about decisions made before code, such as a password reset flow that can be abused, which is why threat modelling a feature during planning is cheaper than fixing it later.
Authentication failures were renamed in 2025 and cover weak passwords, missing multi-factor authentication, poor session expiry and credential stuffing. The Verizon 2025 DBIR found credential abuse was the initial attack vector in 22% of breaches, so login security deserves product time, not just a library default.
Logging, alerting and the new A10
A09 was renamed from monitoring to alerting to stress that logs only help if someone is told when something looks wrong. The OWASP Logging Cheat Sheet recommends recording authentication successes and failures, authorisation failures, admin actions and input validation failures, while never logging passwords, tokens or session identifiers.
A10, Mishandling of Exceptional Conditions, is new. It covers what happens when code meets an error, a timeout or an unexpected value: does it fail closed and deny access, or fail open and carry on? Reviewing error paths in payment, login and permission code is a practical way to start.
A fix order for a small team
Most startups cannot fix all ten areas at once. A sensible order puts the risks that expose customer data first and the slower structural work later. Treat this as a starting plan, then adjust it to what your own testing finds.
- Week 1 to 2: add server-side authorisation checks and cross-tenant tests (A01)
- Week 2 to 3: review cloud and app configuration against a hardening checklist (A02)
- Week 3 to 4: turn on dependency and secret scanning in the repository (A03, A08)
- Month 2: enforce MFA for staff and add rate limits on login (A07)
- Month 2: centralise security logs and set a few high-value alerts (A09)
- Ongoing: threat model new features and review error handling (A06, A10)
How to know the work is paying off
Track a few measures rather than a long report: open high-severity findings, time to fix them, percentage of dependencies on supported versions and whether every production change passed automated checks. IBM's 2025 study puts the global average cost of a breach at USD 4.44 million, which helps frame security time as risk reduction rather than overhead. Independent testing is the honest check. XDQ Labs runs authorised find, fix and verify engagements against the OWASP Top 10 for product teams that want an outside view before an enterprise deal or audit.
Frequently asked questions
What is the OWASP Top 10 in simple terms?
It is a ranked list of the ten most important categories of web application security risk, published by the OWASP Foundation from industry testing data and a community survey. The 2025 edition draws on data from more than 2.8 million applications and is widely used as a baseline in security reviews.
What changed in OWASP Top 10 2025 compared with 2021?
Broken Access Control stays first and now includes SSRF. Security Misconfiguration rose to second. Software Supply Chain Failures replaced the narrower outdated components category, and Mishandling of Exceptional Conditions is new at A10. Injection, Cryptographic Failures and Insecure Design all moved down.
Does a startup need to be OWASP Top 10 compliant?
The OWASP Top 10 is an awareness document, not a certification, so there is no formal compliance. In practice, enterprise buyers and auditors often ask whether you test against it. Being able to show tests, fixes and retests for each category is what matters.
Which OWASP Top 10 risk should a SaaS founder fix first?
Start with Broken Access Control, the top category in both 2021 and 2025. In multi-tenant SaaS it is the risk most likely to expose one customer's data to another. Server-side authorisation checks and automated cross-tenant tests are the core fixes.
Sources
- OWASP Top 10:2025 Introduction, OWASP Foundation, 2025
- Verizon 2025 Data Breach Investigations Report: news release, Verizon, 2025
- Average global data breach cost now $4.44 million (IBM Cost of a Data Breach Report 2025), Help Net Security, 2025
- Supply Chain Compromise of Third-Party GitHub Action, CVE-2025-30066, CISA, 2025
- The State of Secrets Sprawl 2025, GitGuardian, 2025
- Logging Cheat Sheet, OWASP Cheat Sheet Series, 2025
- OWASP API Security Project: API Security Top 10 2023, OWASP Foundation, 2023
