OWASP Top 10:2025 Explained for Indian Development Teams: What Changed Since 2021 and How to Test for It
OWASP Top 10 2025 explained for Indian dev teams: the full list, what changed since 2021, and which testing method catches each risk, from scans to pentests.
OWASP Top 10:2025 Explained for Indian Development Teams: What Changed Since 2021 and How to Test for It
OWASP Top 10 2025 explained for Indian dev teams: the full list, what changed since 2021, and which testing method catches each risk, from scans to pentests.
The OWASP Top 10:2025 is the latest list of the ten most critical web application security risks, published by the OWASP Foundation. It is the eighth edition and is based on data from more than 2.8 million applications. Broken Access Control stays in first place, Security Misconfiguration jumps to number two, and two categories are new: Software Supply Chain Failures and Mishandling of Exceptional Conditions.
For Indian development teams, the practical question is simple: which of these will your current tools catch, and which need a human tester?
The full OWASP Top 10:2025 list
Broken Access Control
Security Misconfiguration
Software Supply Chain Failures
Cryptographic Failures
Injection
Insecure Design
Authentication Failures
Software or Data Integrity Failures
Security Logging and Alerting Failures
Mishandling of Exceptional Conditions
What changed since 2021, in plain English
Here is the change map, one line per move.
Broken Access Control: still first
Server-Side Request Forgery (SSRF), which had its own 2021 spot, is now folded into this category.
Security Misconfiguration: up from fifth to second
OWASP notes that more and more application behaviour now comes from configuration, so mistakes there show up more often.
Software Supply Chain Failures: new at third
NewIt grows the old "Vulnerable and Outdated Components" category to cover the whole chain: dependencies, build systems and how software is distributed. OWASP says it has the fewest occurrences in the data but the highest average exploit and impact scores.
Cryptographic Failures: down from second to fourth
Continues to cover weak ciphers, outdated TLS versions, and unencrypted sensitive data in transit or rest.
Injection: down from third to fifth
It still covers everything from cross-site scripting (XSS) to SQL injection and command injection.
Insecure Design: down from fourth to sixth
OWASP credits better threat modelling and security architecture practices across the industry.
Authentication Failures: still seventh, with a shorter name
It was previously named "Identification and Authentication Failures".
Software or Data Integrity Failures: still eighth
Focuses on code and infrastructure that does not protect against integrity violations, including auto-update modules without verification.
Security Logging and Alerting Failures: still ninth, renamed from "Logging and Monitoring"
The new word matters. OWASP points out that great logging with no alerting does little to catch an incident.
Mishandling of Exceptional Conditions: new at tenth
NewIt covers poor error handling, logical errors and systems that "fail open" when something unexpected happens.
One more detail: OWASP picked eight categories from the testing data and two from a community survey of practitioners. Supply chain and logging both got strong support in that survey, because they are hard to measure with automated tools.
Which testing method catches which risk?
This is the part most "explained" articles skip. No single tool covers all ten. Here is a practical guide to what usually catches what.
Broken Access Control
Security Misconfiguration
Software Supply Chain Failures
Cryptographic Failures
Injection
Insecure Design
Authentication Failures
Software or Data Integrity Failures
Security Logging and Alerting Failures
Mishandling of Exceptional Conditions
The pattern is clear. Tools handle the "known" and the "configured". People handle the "logical" and the "designed".
What this means for Indian teams
Many Indian SaaS and fintech products are built fast on open-source packages, cloud services and third-party APIs for KYC, payments and messaging. That makes three categories worth extra attention.
Supply chain (A03)
Know every package and build tool your product depends on. Pin versions, review new dependencies, and protect your CI/CD pipeline as carefully as production. If you share source code, a source code review covers both your own code and how you pull in others'.
Misconfiguration (A02)
Most Indian startups run on AWS or Azure, and cloud settings change with every new feature. Storage buckets, IAM roles and security groups deserve a regular cloud security review of their own.
Exceptional conditions (A10)
Think about what your app does when the KYC provider times out, the payment callback arrives twice or the database is slow. If the answer is "it lets the user through", that is an A10 issue waiting to be found.
One job per role in your team
The 2025 list is easier to act on when each role owns a slice of it.
Own A01, A04, A05 and A07 in code
Check access on every record, use proven crypto libraries, use parameterised queries and lean on standard authentication frameworks.
Add negative test cases for A10
Send empty, duplicate, oversized and out-of-order requests, and confirm the app fails safely rather than failing open.
Own A02, A03 and A08
Harden configuration, lock down CI/CD pipelines, sign production builds, and track every third-party dependency with SBOMs.
Own A06 and A09
Run threat modelling before shipping major features, and confirm that critical telemetry raises high-priority alerts someone will actually see.
How to test your app against the 2025 list
Run automated scanning and dependency checks continuously in your CI/CD pipeline.
Review cloud and server configuration whenever infrastructure or deployment architecture changes.
Bring in a manual pentest for access control, authentication, business logic and error handling.
Check that your logs actually trigger alerts during active testing simulations.
Fix vulnerabilities, then perform validation retests to prove fixes work in production-like environments.
SecurityLit's web application testing covers the OWASP Top 10 and custom application vulnerabilities, combining automated scanning with manual testing techniques, business logic testing and controlled exploitation.
If you ship every sprint, testing once a year will always lag behind your code. Continuous pentesting keeps pace with releases.
For A09, the real test is your response. If an alert fires at 2 am, someone needs to act. SecurityLit offers incident response support for when that happens.
Frequently Asked Questions
Which risk is ranked first in the OWASP Top 10:2025?
Broken Access Control (A01:2025). It keeps the top position from 2021 and now also includes Server-Side Request Forgery (SSRF).
What are the new categories in the OWASP Top 10:2025?
Software Supply Chain Failures (A03:2025) and Mishandling of Exceptional Conditions (A10:2025). Supply chain expands the 2021 "Vulnerable and Outdated Components" category.
Where did SSRF go in the 2025 list?
OWASP rolled Server-Side Request Forgery into A01:2025 Broken Access Control.
Is the OWASP Top 10 a compliance standard?
No. It is an awareness document that ranks common risks. Many teams and auditors use it as a baseline for secure coding and testing, but it is not a formal certification.
Can a vulnerability scanner cover the full OWASP Top 10:2025?
No. Scanners help with misconfiguration, known vulnerable components and many injection patterns. Access control, insecure design, authentication logic and exceptional conditions usually need manual testing.
Should Indian teams also use the OWASP API Security Top 10?
Yes, if you expose APIs. The OWASP Top 10 covers web applications broadly, while the API Security Top 10 (2023) focuses on API-specific risks such as broken object level authorization (BOLA).
Want your application tested against the OWASP Top 10:2025, with a retest after fixes?
Book a free scoping call with SecurityLit or get an instant estimate for web application testing.
The OWASP Top 10:2025 is the latest list of the ten most critical web application security risks, published by the OWASP Foundation. It is the eighth edition and is based on data from more than 2.8 million applications. Broken Access Control stays in first place, Security Misconfiguration jumps to number two, and two categories are new: Software Supply Chain Failures and Mishandling of Exceptional Conditions.
For Indian development teams, the practical question is simple: which of these will your current tools catch, and which need a human tester?
The full OWASP Top 10:2025 list
Broken Access Control
Security Misconfiguration
Software Supply Chain Failures
Cryptographic Failures
Injection
Insecure Design
Authentication Failures
Software or Data Integrity Failures
Security Logging and Alerting Failures
Mishandling of Exceptional Conditions
What changed since 2021, in plain English
Here is the change map, one line per move.
Broken Access Control: still first
Server-Side Request Forgery (SSRF), which had its own 2021 spot, is now folded into this category.
Security Misconfiguration: up from fifth to second
OWASP notes that more and more application behaviour now comes from configuration, so mistakes there show up more often.
Software Supply Chain Failures: new at third
NewIt grows the old "Vulnerable and Outdated Components" category to cover the whole chain: dependencies, build systems and how software is distributed. OWASP says it has the fewest occurrences in the data but the highest average exploit and impact scores.
Cryptographic Failures: down from second to fourth
Continues to cover weak ciphers, outdated TLS versions, and unencrypted sensitive data in transit or rest.
Injection: down from third to fifth
It still covers everything from cross-site scripting (XSS) to SQL injection and command injection.
Insecure Design: down from fourth to sixth
OWASP credits better threat modelling and security architecture practices across the industry.
Authentication Failures: still seventh, with a shorter name
It was previously named "Identification and Authentication Failures".
Software or Data Integrity Failures: still eighth
Focuses on code and infrastructure that does not protect against integrity violations, including auto-update modules without verification.
Security Logging and Alerting Failures: still ninth, renamed from "Logging and Monitoring"
The new word matters. OWASP points out that great logging with no alerting does little to catch an incident.
Mishandling of Exceptional Conditions: new at tenth
NewIt covers poor error handling, logical errors and systems that "fail open" when something unexpected happens.
One more detail: OWASP picked eight categories from the testing data and two from a community survey of practitioners. Supply chain and logging both got strong support in that survey, because they are hard to measure with automated tools.
Which testing method catches which risk?
This is the part most "explained" articles skip. No single tool covers all ten. Here is a practical guide to what usually catches what.
Broken Access Control
Security Misconfiguration
Software Supply Chain Failures
Cryptographic Failures
Injection
Insecure Design
Authentication Failures
Software or Data Integrity Failures
Security Logging and Alerting Failures
Mishandling of Exceptional Conditions
The pattern is clear. Tools handle the "known" and the "configured". People handle the "logical" and the "designed".
What this means for Indian teams
Many Indian SaaS and fintech products are built fast on open-source packages, cloud services and third-party APIs for KYC, payments and messaging. That makes three categories worth extra attention.
Supply chain (A03)
Know every package and build tool your product depends on. Pin versions, review new dependencies, and protect your CI/CD pipeline as carefully as production. If you share source code, a source code review covers both your own code and how you pull in others'.
Misconfiguration (A02)
Most Indian startups run on AWS or Azure, and cloud settings change with every new feature. Storage buckets, IAM roles and security groups deserve a regular cloud security review of their own.
Exceptional conditions (A10)
Think about what your app does when the KYC provider times out, the payment callback arrives twice or the database is slow. If the answer is "it lets the user through", that is an A10 issue waiting to be found.
One job per role in your team
The 2025 list is easier to act on when each role owns a slice of it.
Own A01, A04, A05 and A07 in code
Check access on every record, use proven crypto libraries, use parameterised queries and lean on standard authentication frameworks.
Add negative test cases for A10
Send empty, duplicate, oversized and out-of-order requests, and confirm the app fails safely rather than failing open.
Own A02, A03 and A08
Harden configuration, lock down CI/CD pipelines, sign production builds, and track every third-party dependency with SBOMs.
Own A06 and A09
Run threat modelling before shipping major features, and confirm that critical telemetry raises high-priority alerts someone will actually see.
How to test your app against the 2025 list
Run automated scanning and dependency checks continuously in your CI/CD pipeline.
Review cloud and server configuration whenever infrastructure or deployment architecture changes.
Bring in a manual pentest for access control, authentication, business logic and error handling.
Check that your logs actually trigger alerts during active testing simulations.
Fix vulnerabilities, then perform validation retests to prove fixes work in production-like environments.
SecurityLit's web application testing covers the OWASP Top 10 and custom application vulnerabilities, combining automated scanning with manual testing techniques, business logic testing and controlled exploitation.
If you ship every sprint, testing once a year will always lag behind your code. Continuous pentesting keeps pace with releases.
For A09, the real test is your response. If an alert fires at 2 am, someone needs to act. SecurityLit offers incident response support for when that happens.
Frequently Asked Questions
Which risk is ranked first in the OWASP Top 10:2025?
Broken Access Control (A01:2025). It keeps the top position from 2021 and now also includes Server-Side Request Forgery (SSRF).
What are the new categories in the OWASP Top 10:2025?
Software Supply Chain Failures (A03:2025) and Mishandling of Exceptional Conditions (A10:2025). Supply chain expands the 2021 "Vulnerable and Outdated Components" category.
Where did SSRF go in the 2025 list?
OWASP rolled Server-Side Request Forgery into A01:2025 Broken Access Control.
Is the OWASP Top 10 a compliance standard?
No. It is an awareness document that ranks common risks. Many teams and auditors use it as a baseline for secure coding and testing, but it is not a formal certification.
Can a vulnerability scanner cover the full OWASP Top 10:2025?
No. Scanners help with misconfiguration, known vulnerable components and many injection patterns. Access control, insecure design, authentication logic and exceptional conditions usually need manual testing.
Should Indian teams also use the OWASP API Security Top 10?
Yes, if you expose APIs. The OWASP Top 10 covers web applications broadly, while the API Security Top 10 (2023) focuses on API-specific risks such as broken object level authorization (BOLA).
Want your application tested against the OWASP Top 10:2025, with a retest after fixes?
Book a free scoping call with SecurityLit or get an instant estimate for web application testing.