Topic starter
20/08/2026 5:33 pm
TL;DR: OWASP’s 2025 Top 10 reflects a structural shift in application risk, with security misconfiguration rising and software supply chain failures widening the attack surface, according to Sprocket Security. Static scans and point-in-time reviews are no longer enough when change itself now drives exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Sprocket Security: “What’s New in OWASP 2025: Configuration Drift, Supply Chain Risk, and Continuous Testing”.
By the numbers:
- Security misconfiguration surged three spots up OWASP’s 2025 Top 10.
Key questions
Q: How should privacy teams implement CPRA controls in cloud and API environments?
A: Start by mapping where personal and sensitive personal information actually moves, then enforce purpose-based access and traceable rights workflows across those paths.
Q: Why do software supply chain failures create risk even when application code is unchanged?
A: Because the risk often enters through components around the code, not the code itself.
Q: How do security teams know if recon findings are showing real exposure drift?
A: Look for repeated discoveries of stale subdomains, forgotten documentation, exposed secrets, or orphaned endpoints across different scans and testers.
Practitioner guidance
- Continuously verify runtime configuration Track policy, IAM, container, and API settings in the live environment rather than relying on release-time checks or quarterly reviews.
- Map and test the full delivery chain Inventory build systems, CI/CD integrations, dependency sources, and deployment connectors so you can test the assembled system instead of only the codebase.
- Reduce trust in third-party components Review where external packages, actions, APIs, and images can influence production behavior and remove permissions that are not essential to operation.
Bottom line: The 2025 OWASP update shows that appsec risk is increasingly created by misconfiguration, drift, and dependency exposure rather than only by defects in source code.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:20 pm
Misconfiguration is now a first-class attack surface: OWASP 2025 reflects a reality many teams still underweight. In cloud and API-heavy environments, small policy errors can become the easiest way into an application because they are live, reachable, and often invisible to code-focused tooling. For IAM and PAM teams, the lesson is that access governance and appsec are converging around the same failure mode: the environment changes faster than the control record. Practitioners need to treat configuration state as part of the attack surface, not as a deployment afterthought.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: What should teams do when third-party dependencies can alter production behavior?
A: Treat third-party influence as part of the trust model and narrow it to the minimum required scope. That means reviewing which packages, actions, APIs, and images can change production behavior, then removing unnecessary privilege and validating the full chain that delivers software into production.
👉 Read our full editorial: OWASP 2025 shifts appsec toward misconfiguration and supply chains