OWASP Top 10 2025: The threat landscape has changed – and development must change with it
What can be learned from the trends of recent years, and how it affects application security today
Over the past decade, the world of development has undergone a true revolution. Applications are now built at an unprecedented pace, utilizing extensive use of Frameworks, ORMs, third-party libraries, cloud services, and CI/CD, and heaven forbid we don’t mention the word AI. This change has created a tremendous business advantage, but simultaneously, it has deeply altered the face of threats. The OWASP Top 10 candidates for 2025 accurately reflect the new reality and present a clear picture: the central threats no longer stem solely from problematic lines of code, but from a combination of design, processes, and external dependencies.
Trends Over the Years
What the OWASP graphs tell us about application security
Analyzing the changes in OWASP Top 10 rankings over the years shows a sharp shift from classic technical vulnerabilities to deeper systemic issues.
In the past, categories like Injection topped the list almost constantly. Today, thanks to the use of ORMs, Prepared Statements, and modern Frameworks, these vulnerabilities are handled by default and therefore appear less frequently and lower in the rankings.
In their place, categories that point to failures not automatically solved by technology have risen. Broken access control, insecure design, software supply chain failures, and insufficient monitoring have become the central threats. The meaning is clear: security no longer depends only on writing code correctly, but on a systemic understanding of how the application is built, who accesses what, and which external components are integrated into it.
A01 – Broken Access Control
Why access control doesn’t “come for free” even with an advanced Framework
Despite all technological progress, Broken Access Control continues to lead the list in 2025. One of the main reasons for this is the erroneous assumption that access control is something a Framework “handles on its own.” In practice, a Framework can offer tools and mechanisms, but it does not understand the business logic, the unique permissions, and the organization’s workflows.
During penetration tests, we repeatedly see cases where a new Endpoint is added without sufficient server-side permission checks, a small change in the API opens access to a critical action, or a simple user in the system receives capabilities they were never intended to have. Access control must be implemented manually, consistently, and consciously, otherwise it becomes one of the most dangerous points of failure in the system.
A03 – Software Supply Chain Failures
When the threat comes from a component you trust
One of the most significant entries into the OWASP Top 10 2025 is Software Supply Chain Failures. In the modern development world, an application almost never stands on its own. It relies on dozens and sometimes hundreds of third-party components, from code libraries to files loaded from an external CDN.
The meaning is that the security of your product also depends on factors not under your direct control. Security incidents from recent years have proven that even a seemingly “innocent” library, such as a UI component or animation, can become an attack vector that reaches end-users directly.
Without controls, version verification, and risk management of third-party components, any application could become a victim of an attack completely unrelated to the code written within the organization.
A06 – Insecure Design
Why security problems start long before the development phase
OWASP emphasizes a critical point in 2025: many security issues are not bugs, but rather the result of faulty design. Decisions made during the specification and architecture phases, such as trust assumptions regarding users, business flows without controls, or lack of user state verification, create security gaps that are very difficult to close at later stages.
Penetration tests can reveal the problem, but they cannot “fix” poor design. Security must be an integral part of the thinking process from the very initial stage of building the system.
In one of the penetration tests we performed, we identified that the authentication mechanism was built of two separate stages: checking an ID card and comparing it to data in the system, and if it exists – checking a mobile phone associated with the ID. The separation of these stages is what allowed us to perform a Brute-Force attack guessing all possible ID numbers until an existing ID in the system was found, and subsequently another Brute-Force attack on the associated phone number, or even – searching exposed databases for the link between the found ID and the user’s phone. Thus any malicious external actor could perform enumeration of personal details of users (ID and phone).
Add to this “recipe” a Brute-Force attack on the OTP code sent to the mobile – and we obtained a complete bypass of the identity verification process for the system.
What this means for organizations and development teams
A change in perception, not just a technological change
OWASP Top 10 2025 delivers a sharp and clear message: application security is not the responsibility of one component or one team. It requires a combination of secure design, conscious development, dedicated testing, and continuous risk management. Automated tools are important, but they are no substitute for human understanding of the application and the threats surrounding it.
Summary
OWASP Top 10 2025 is a mirror to the new reality
The updated list is not just a collection of categories, but a reflection of how applications are built and operated today. Major threats no longer hide only in lines of code, but in processes, decisions, and external dependencies. Organizations that understand this and adapt their development, control, and testing processes will succeed in reducing risks and staying one step ahead of attackers.
The trends presented by OWASP Top 10 2025 make one thing clear:
Application security is no longer limited to automated scans or point-in-time code reviews.
Vulnerabilities like Broken Access Control, Insecure Design, and Software Supply Chain Failures require a deep understanding of the business logic, development processes, and how the application truly operates.
Do you really know what permissions exist at every Endpoint?
Which third-party libraries are loaded for your users?
And which design assumptions might turn into a security breach?
A comprehensive application penetration test, tailored to OWASP Top 10 2025, allows you to answer these questions before an attacker does it for you.