The OWASP Top 10:2025, and what testing each one requires.

The 2025 edition leads with broken access control and security misconfiguration, and introduces software supply chain failures as its own category.

Security misconfiguration, cryptographic failures and much of injection are partly reachable by tooling, because they have recognizable signatures. A scanner can tell you a header is missing or a parameter reflects input.

Broken access control, insecure design and logging failures are not signature problems. Access control requires two accounts and a comparison. Insecure design requires understanding what the feature is for. Logging failures require asking whether anyone would have noticed the test, which is a question you ask your own team.

Making the supply chain its own category reflects where incidents have been coming from: not the code you wrote, but the code and build infrastructure you pulled in.

Testing it reaches past the running application into your dependencies and your build process. A dependency with a known vulnerability is only a finding if it is reachable from your code, so the useful version of this work separates "present in the lockfile" from "callable in production", which is also how you avoid handing a team a thousand-line report nobody triages.

Security logging and alerting failures are the one category that a test finds by comparing notes afterwards. Everything a tester did was logged somewhere, or it was not.

So the question at the end of an engagement is: what did your monitoring see? If a tester spent a week against your application and nothing fired, that is a finding whose severity is independent of every other finding in the report.

A report organized by OWASP category is easier for developers to act on, because the categories are already in their vocabulary and map to the guidance they will look up.

It is still not the scope. Business logic abuse specific to your product, a workflow that can be replayed for financial gain, a tenant isolation gap peculiar to your architecture: these land where they land on the list, and they go in the report regardless. OWASP also publishes the Web Security Testing Guide, which is the procedural companion to the risk list.