OWASP Top 10:2025 Explained: What Changed, and Why Point-in-Time Testing Misses It

OWASP finalised the Top 10:2025 in January 2026 after analysing over 175,000 CVEs across 248 CWEs. Two categories are brand new, one disappeared entirely, and Security Misconfiguration jumped from 5th to 2nd. Here's exactly what changed, why it changed, and why a list this data-driven deserves more than an annual checkbox test.

Key takeaways

• The OWASP Top 10:2025 was announced at the OWASP Global AppSec Conference in Washington, D.C. in November 2025, with the final version released in January 2026, built on analysis of 175,000+ CVEs mapped across 248 CWEs plus practitioner survey data from thousands of organisations.
• Broken Access Control stays at number one for the second edition running — it held the top spot in 2021 too.
• Two entirely new categories entered the list: Software Supply Chain Failures (A03) and Mishandling of Exceptional Conditions (A10).
• Server-Side Request Forgery, which had its own category in 2021 (A10), was absorbed into Broken Access Control rather than retained separately.
• Security Misconfiguration jumped from 5th to 2nd — one of four significant re-rankings, alongside Cryptographic Failures, Injection and Insecure Design each moving down two places.
• Three categories were renamed to better reflect current risk: Identification and Authentication Failures → Authentication Failures; Software and Data Integrity Failures → Software or Data Integrity Failures; Security Logging and Monitoring Failures → Security Logging and Alerting Failures.

The full OWASP Top 10:2025 list, ranked

Here's the complete ranking, with what changed from the 2021 edition next to each category.

Notice what's missing from the 2021 list: Vulnerable and Outdated Components as a standalone category. That risk didn't disappear — it's now absorbed into the broader, more accurate Software Supply Chain Failures category, which covers dependency risk alongside build pipeline, artifact integrity and third-party package compromise. That's a more honest description of how most real supply chain incidents actually happen.

Why the reshuffle happened

OWASP doesn't rank these by opinion. The 2025 edition is built from two data sources layered together: a large-scale analysis of CVE and CWE data across real-world vulnerability disclosures, and a practitioner survey capturing what security teams are actually seeing in the field. When both sources point the same direction, a category moves.

That's why Security Misconfiguration's jump from 5th to 2nd matters more than it might look. It's not a ranking curiosity — it reflects how much application risk now originates in cloud infrastructure, CI/CD pipelines and deployment configuration rather than in classical application-layer code. Teams that only pentest the application and treat infrastructure configuration as someone else's problem are testing an increasingly smaller share of their actual risk surface.

Similarly, Software Supply Chain Failures earning a top-three slot on its first appearance reflects a category of incident that barely existed in the 2021 threat model: compromised build pipelines, poisoned dependencies, and artifact tampering between commit and production. The list changed because the risk landscape changed under it, not the other way around.

Why a data-driven, moving list breaks point-in-time testing

A pentest scoped against the 2021 categories has a structural blind spot against the 2025 ones — not because the tester missed something, but because Software Supply Chain Failures and Mishandling of Exceptional Conditions as standalone categories simply didn't exist as testing scope items four years ago. If your last comprehensive pentest predates January 2026, there's a real chance it never explicitly tested for either.

The deeper problem isn't the framework version, though — it's the gap between review cycles. Applications ship new code, new dependencies and new cloud configuration continuously. Each of those can independently introduce a Top 10 risk. An annual pentest gives you a report that's accurate on delivery day and stale within weeks, because:

• New dependencies ship weekly. A single package update can introduce a Software Supply Chain Failure that wasn't present when the last assessment ran.
• Infrastructure configuration drifts. A permissive S3 bucket policy or an exposed admin panel can appear between deploys without a code change triggering review.
• Access control logic changes with every new feature. Broken Access Control has been #1 for two editions running precisely because authorization logic is where new features most often quietly break old assumptions.

"The Top 10 changed because the risk landscape changed under it. A pentest scoped once a year can't keep pace with a framework that's rebuilt from 175,000 fresh CVEs every few years — let alone with your own weekly deploys."

How ComplyArmor maps to OWASP Top 10:2025

ComplyArmor's Smart PTaaS runs autonomous, continuous vulnerability discovery and exploitation across your attack surface, with every finding that meets a confidence threshold verified by a human tester before it reaches your dashboard. Findings are mapped directly to OWASP Top 10:2025 categories — including the two new ones — alongside major compliance frameworks like SOC 2 and ISO 27001.

• Continuous discovery, not annual snapshots. New endpoints, dependencies and configuration changes get tested as they appear, not on a fixed yearly cycle.
• Expert-verified findings. Automated discovery surfaces candidates; a human tester confirms exploitability before you see it, so your team acts on signal, not noise.
• Direct OWASP and compliance mapping. Every finding is tagged to its OWASP Top 10:2025 category and cross-referenced against the compliance frameworks your auditors expect.
• Audit-ready reporting. One dashboard, one report format, built for security teams, engineering and auditors to work from the same evidence.

Questions worth asking your current security testing provider

Whether you test in-house or work with a vendor, these questions separate a real OWASP Top 10:2025 program from a checkbox exercise:

1. Does the scope explicitly cover Software Supply Chain Failures and Mishandling of Exceptional Conditions? If your last report predates January 2026, it probably doesn't.
2. How are findings validated before they reach us? Automated-only output produces false positives that waste remediation time.
3. What happens between scheduled tests? A new dependency or config change three months into an annual cycle goes untested until the next one.
4. Do reports map directly to OWASP Top 10:2025 and to our compliance framework — or do we have to translate findings ourselves for auditors?
5. Can we see what changed since the last assessment, or only a fresh static snapshot each time?

Frequently asked questions

OWASP rebuilt this list from 175,000 fresh CVEs because the last one stopped reflecting reality. Your last pentest report is aging the same way, just quietly, and without 175,000 data points telling you when it happened.