Notifications
Clear all
Topic starter
20/08/2026 6:04 pm
TL;DR: OWASP Top 10 2025 shifts application security toward software supply chain failures and LLM-specific threats, with Cycode framing the update as a call for continuous inventory, automated testing, and policy-driven controls across the SDLC. The practical consequence is that security teams must govern code, dependencies, pipelines, and AI-generated output as one risk surface, not separate problems.
NHIMG editorial — based on content published by Cycode: OWASP Top 10 2025: Addressing Software Supply Chain and LLM Risks with Cycode
Questions worth separating out
Q: How should security teams govern AI agents and LLM tools in the SDLC?
A: Treat AI agents and LLM integrations as privileged workloads with explicit identity, task scope, and approval boundaries.
Q: Why do software supply chains create identity governance risk?
A: Because the identities that sign, build, approve, and deploy software can change the final outcome more than the code itself.
Q: What breaks when secrets are stored in code and CI/CD tools?
A: Access becomes invisible, reusable, and hard to revoke, which means the organisation loses control of where authentication material exists.
Practitioner guidance
- Implement identity-aware pipeline governance Assign a named owner to every source control, build, signing, and release identity, then review its privileges against task scope and approval boundaries.
- Enforce provenance checks before promotion Require signed builds, dependency verification, and artifact attestation before code can move from test to production environments.
- Constrain AI tools to task-scoped access Limit LLM and agent tool calls to the minimum internal APIs, repositories, and data stores needed for the task, then log every escalation path.
What's in the full article
Cycode's full analysis covers the operational detail this post intentionally leaves for the source:
- Specific mappings between OWASP Top 10 2025 categories and SDLC control points across source control, CI/CD, and runtime
- Examples of continuous remediation workflows for exposed secrets, signed artefacts, and dependency verification
- Implementation guidance for LLM and AI-generated code risk controls inside application security programmes
- Practical policy gate ideas for teams that need to reduce OWASP 10 exposure without slowing delivery
👉 Read Cycode's analysis of OWASP Top 10 2025 and AI-driven appsec risk →
OWASP Top 10 2025: what appsec teams need to change?
Explore further
20/08/2026 6:40 pm
OWASP Top 10 2025 confirms that appsec is now an identity governance problem as much as a code quality problem. Once supply chain compromise, CI/CD privilege, and AI-generated output are in scope, the question is no longer only whether code is vulnerable. It is who can introduce trust into the pipeline, which identities can promote it, and how quickly abuse can propagate across automated delivery. Practitioners should treat privileged build paths as governed identities, not invisible infrastructure.
A question worth separating out:
Q: Who is accountable when an AI coding tool introduces insecure code into production?
A: Accountability stays with the organisation that allowed the tool to operate without enforced guardrails. The model is not the accountable party. Security, engineering, and platform owners share responsibility for defining policy, enforcing it at runtime, and logging the decision trail that proves controls were applied.
👉 Read our full editorial: OWASP Top 10 2025 elevates supply chain and LLM risk
