Notifications
Clear all
Topic starter
19/08/2026 4:05 pm
TL;DR: Application security is shifting from a vulnerability list toward a resilience model, with Software Supply Chain Failures, Security Misconfiguration, and Mishandling of Exceptional Conditions rising or entering the ranking, according to Equixly’s analysis of the OWASP Top 10 2025 RC. The change matters because access control, configuration governance, and dependency trust now shape exploitability as much as code defects do.
NHIMG editorial — based on content published by Equixly: OWASP Top 10 2025 vs 2021, what has changed?
Questions worth separating out
Q: What breaks when broken access control is treated as a purely application-layer issue?
A: Teams miss the service and token boundaries where authorization actually fails.
Q: Why do cloud-native environments make vulnerability management harder?
A: Because infrastructure changes faster than traditional scan cycles can keep up.
Q: What do security teams get wrong about software supply chain risk?
A: They often focus on known vulnerabilities inside dependencies and miss the trust path that delivers the software.
Practitioner guidance
- Re-test object-level authorisation paths Build authenticated test cases for user-to-user, tenant-to-tenant, and service-to-service access checks.
- Continuously validate cloud and runtime configurations Automate checks for overly permissive IAM roles, exposed management interfaces, insecure headers, and misconfigured container settings in CI/CD and at runtime.
- Extend trust controls to the software supply chain Require provenance checks, signing verification, dependency review, and pipeline segmentation for build systems and registries.
What's in the full article
Equixly's full blog post covers the technical comparison this post intentionally leaves at the strategy layer:
- The detailed 2021 to 2025 category-by-category comparison, including how each OWASP risk moved and why.
- The article’s deeper treatment of SSRF, broken access control, and the way OWASP is reframing trust boundaries.
- The breakdown of supply chain, misconfiguration, and authentication changes across cloud-native and API-heavy environments.
- The relationship between the web Top 10 and the OWASP API Security Top 10 for practitioners deciding which standard to apply.
👉 Read Equixly’s analysis of what changed in OWASP Top 10 2025 versus 2021 →
OWASP Top 10 2025 vs 2021: what changed for appsec teams?
Explore further
19/08/2026 4:39 pm
Broken access control is increasingly a governance failure, not just a coding flaw. The 2025 ranking reinforces that entitlement logic is still the hardest appsec problem because it depends on business context and object ownership. In identity terms, this is where authorization, RBAC, and API security intersect most sharply. Practitioners should treat access control testing as a core governance control, not a niche AppSec exercise.
A question worth separating out:
Q: How should teams respond when error handling becomes a security boundary?
A: Teams should test exception paths with the same rigour they apply to normal workflows. If a service fails open, exposes unauthorised data, or skips an auth check when a dependency is unavailable, attackers will look for that path. Resilience and security need to be assessed together, especially in distributed systems.
👉 Read our full editorial: OWASP Top 10 2025 shifts appsec toward resilience and supply chain risk
