Topic starter
20/08/2026 6:04 pm
TL;DR: OWASP Top 10 2025 shifts application security toward software supply chain failures and LLM-specific threats, with Cycode framing the update as a call for continuous inventory, automated testing, and policy-driven controls across the SDLC. The practical consequence is that security teams must govern code, dependencies, pipelines, and AI-generated output as one risk surface, not separate problems.
Editorial analysis by NHI Mgmt Group, based on content published by Cycode: “OWASP Top 10 2025: Addressing Software Supply Chain and LLM Risks with Cycode”.
Key questions
Q: What breaks when software supply chain controls are only partially automated?
A: Partial automation creates inconsistent enforcement, which means some builds are protected while others slip through manual exceptions or forgotten paths.
Q: Why do LLM-powered applications need more than access control to stay secure?
A: Access control limits who can reach the system, but it does not control what the model may do once it is invoked.
Q: What are the signs that an SDLC policy is failing in practice?
A: Common warning signs include production changes that bypass review, poor separation between development and production data, unclear ownership of code changes, and missing records for testing or approval.
Practitioner guidance
- Audit pipeline trust boundaries Map where code, dependencies, signing keys, and release permissions cross trust boundaries, then remove unnecessary write access from build and deployment paths.
- Enforce provenance checks on artifacts Require signed builds, dependency verification, and artifact attestation before promotion into higher environments, especially where third-party components are introduced.
- Gate AI-generated code with policy Apply the same quality and security gates to AI-generated code as to human-authored code, including dependency review, test coverage, and approval workflows.
Bottom line: OWASP Top 10 2025 shifts appsec from isolated code defects to ecosystem trust, especially across supply chains and LLM-enabled workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:40 pm
Software supply chain trust is now an identity problem as much as a code problem. Once build systems, package registries, and signing keys become the trust anchor for delivery, the question is who or what is allowed to introduce change. That makes secrets governance, maintainer authentication, and pipeline privilege part of AppSec governance rather than a separate operational concern. Practitioners should treat provenance as a control plane, not a reporting artefact.
A few things that frame the scale:
- Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should appsec teams govern supply chain and LLM risk together?
A: They should use one control model for source, build, dependency, and AI-assisted development paths. The practical goal is to align inventory, policy gates, and runtime monitoring so the same trust rules apply whether code was written by a person, generated by a model, or pulled from a third-party package.
👉 Read our full editorial: OWASP Top 10 2025 elevates supply chain and LLM risk