Topic starter
19/08/2026 4:05 pm
TL;DR: Application security is shifting from a vulnerability list toward a resilience model, with Software Supply Chain Failures, Security Misconfiguration, and Mishandling of Exceptional Conditions rising or entering the ranking, according to Equixly’s analysis of the OWASP Top 10 2025 RC. The change matters because access control, configuration governance, and dependency trust now shape exploitability as much as code defects do.
Editorial analysis by NHI Mgmt Group, based on content published by Equixly: “OWASP Top 10 2025 vs 2021: What Has Changed?”.
By the numbers:
- The OWASP Top 10 2025 release candidate places security misconfiguration in second place, up from fifth in 2021.
- Equixly says the security community ranked software supply chain failures as its top concern with 50% of survey respondents.
Key questions
Q: What breaks when broken access control is not tested with real identities?
A: Teams miss the decisions that matter most because authorization is contextual.
A: Cloud-native systems move fast, so a small error in IAM, pipeline integrity, or infrastructure-as-code can quickly become production exposure.
Q: What do security teams get wrong about software supply chain risk?
A: They often focus on known vulnerabilities inside dependencies and miss the trust path that delivers the software.
Practitioner guidance
- Test authorization with authenticated identities Use multi-role and service-account test cases to validate object-level access, tenant boundaries, and API authorization decisions under real credentials.
- Continuously validate cloud and runtime configuration Scan deployed environments for exposed management interfaces, permissive IAM roles, unsafe defaults, and container settings as part of release validation.
- Govern build and release credentials as machine identities Inventory the identities used by CI/CD, package delivery, and artifact publishing, then scope their permissions to the minimum required task.
Bottom line: OWASP’s 2025 draft ranking shows that appsec is moving beyond vulnerability hunting toward control assurance across access, configuration, and delivery paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:39 pm
Application resilience has become an identity and trust governance problem. The article shows that the old separation between AppSec, IAM, and platform security is no longer defensible. Access control, configuration control, and supply chain trust now interact at runtime, which means governance has to follow the path of execution rather than the perimeter of the codebase. Practitioners should treat authorization and trusted automation as one control surface.
A few things that frame the scale:
- Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey.
- More than 80% of enterprises will have used generative AI APIs or deployed GenAI applications by 2026, up from 5% in 2023, according to Gartner.
A question worth separating out:
Q: What should appsec and IAM teams do when a control can fail open?
A: They should test the error path, not just the success path. If an authentication check, dependency lookup, or policy evaluation fails, the system must deny access or degrade safely. Any silent fallback that grants access or suppresses enforcement turns an exception into a security decision.
👉 Read our full editorial: OWASP Top 10 2025 shifts appsec toward resilience and supply chain risk