Topic starter
02/08/2026 9:44 am
TL;DR: OWASP Foundation's 2025 Top 10 adds Software Supply Chain Failures and Mishandling of Exceptional Conditions, with Semgrep's analysis linking the update to risk beyond source code. AppSec teams now have to govern build provenance, dependency trust, and error paths as part of release control.
Editorial analysis by NHI Mgmt Group, based on content published by Semgrep: “OWASP Top 10 2025: What's New”.
By the numbers:
- Semgrep also drew on 340k repositories in its analysis.
- The analysis covered 13k organizations.
- Semgrep updated more than 4,000 rules to map findings to the new OWASP Top 10 categories.
Key questions
Q: Why does software supply chain risk now matter more in application security?
A: Because modern applications depend on code, packages, build systems, and update channels that can all be compromised independently of source code quality.
Q: What breaks when exception handling is not part of appsec review?
A: Systems can leak sensitive data through error messages, crash unpredictably, or expose internal states that should remain hidden.
Q: What should application security teams do first after the OWASP Top 10 2025 update?
A: Start by remapping existing findings to the new categories, then identify where supply chain integrity, access control, and exception handling controls are missing or weak.
Practitioner guidance
- Review build provenance controls Inventory where dependencies are introduced, who can modify build pipelines, and how artifacts are signed before release.
- Test exception handling under failure states Exercise malformed inputs, partial outages, and denied access paths to verify that applications fail closed and do not leak internal detail through verbose error messages or unexpected crashes.
- Map SSRF exposure to access boundaries Review every route that can trigger server-side requests, callback handling, or internal fetch logic, and confirm that each path is constrained by explicit authorization and network segmentation.
Bottom line: OWASP Top 10 2025 moves application security beyond code-centric defect hunting and toward control over supply chains, access boundaries, and failure behaviour.
Glossary terms: Software Supply Chain Failure, Broken Access Control, Exceptional Conditions, Artifact Integrity Check
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 12:37 pm
Software supply chain risk is now an application security governance problem, not just a developer hygiene problem. The 2025 OWASP Top 10 makes clear that compromised dependencies, tampered builds, and insecure updates belong in the core risk model. That changes ownership: security teams must govern artifact trust, pipeline credentials, and release integrity with the same seriousness they apply to code review and vulnerability remediation. Practitioners should treat supply chain integrity as an AppSec control surface.
A question worth separating out:
Q: How should teams test whether SSRF-like paths are actually contained?
A: Review request flows that can reach internal services, callback endpoints, or proxy logic, and confirm they are governed by explicit authorization and segmentation. If an application can be persuaded to fetch resources it should not reach, the control failure is usually broader than a single vulnerable endpoint.
👉 Read our full editorial: OWASP Top 10 2025 pushes appsec toward lifecycle controls
This post was modified 2 days ago by NHI Mgmt Group