Topic starter
02/08/2026 9:44 am
TL;DR: OWASP’s 2025 Top 10 adds Software Supply Chain Failures and Mishandling of Exceptional Conditions, while rolling SSRF into Broken Access Control, reflecting a broader shift from code-only risk toward lifecycle and access-control failures, according to Semgrep’s analysis. The practical takeaway is that AppSec programmes now need to govern build integrity, exception handling, and access paths alongside traditional vulnerability classes.
Editorial analysis by NHI Mgmt Group, based on content published by Semgrep: “OWASP Top 10 2025: What's New”.
By the numbers:
- Semgrep also drew on 340k repositories in its analysis.
- The analysis covered 13k organizations.
- Semgrep updated more than 4,000 rules to map findings to the new OWASP Top 10 categories.
Key questions
Q: What should application security teams do first after the OWASP Top 10 2025 update?
A: Start by remapping existing findings to the new categories, then identify where supply chain integrity, access control, and exception handling controls are missing or weak.
Q: Why does software supply chain risk now matter more in application security?
A: Because modern applications depend on code, packages, build systems, and update channels that can all be compromised independently of source code quality.
Q: What breaks when exception handling is not part of appsec review?
A: Systems can leak sensitive data through error messages, crash unpredictably, or expose internal states that should remain hidden.
Practitioner guidance
- Review build provenance controls Inventory where dependencies are introduced, who can modify build pipelines, and how artifacts are signed before release.
- Test exception handling under failure states Exercise malformed inputs, partial outages, and denied access paths to verify that applications fail closed and do not leak internal detail through verbose error messages or unexpected crashes.
- Map SSRF exposure to access boundaries Review every route that can trigger server-side requests, callback handling, or internal fetch logic, and confirm that each path is constrained by explicit authorization and network segmentation.
Bottom line: OWASP Top 10 2025 moves application security beyond code-centric defect hunting and toward control over supply chains, access boundaries, and failure behaviour.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:37 pm
Software supply chain risk is now an application security governance problem, not just a developer hygiene problem. The 2025 OWASP Top 10 makes clear that compromised dependencies, tampered builds, and insecure updates belong in the core risk model. That changes ownership: security teams must govern artifact trust, pipeline credentials, and release integrity with the same seriousness they apply to code review and vulnerability remediation. Practitioners should treat supply chain integrity as an AppSec control surface.
A question worth separating out:
Q: How should teams test whether SSRF-like paths are actually contained?
A: Review request flows that can reach internal services, callback endpoints, or proxy logic, and confirm they are governed by explicit authorization and segmentation. If an application can be persuaded to fetch resources it should not reach, the control failure is usually broader than a single vulnerable endpoint.
👉 Read our full editorial: OWASP Top 10 2025 shifts appsec risk toward supply chains