Align with the OWASP Top 10 and build safer web applications

The OWASP Top 10:2025 is the eighth edition of the OWASP Foundation's list of the most critical web application security risks. It groups related software weaknesses into ten categories, from A01 Broken Access Control to A10 Mishandling of Exceptional Conditions, and gives examples and prevention guidance for each. It is based on test data from over 2.8 million applications and a community survey of practitioners.

The 2025 edition adds two new categories and one consolidation. Software Supply Chain Failures (A03) expands the 2021 Vulnerable and Outdated Components category, and Mishandling of Exceptional Conditions (A10) is new. Server-Side Request Forgery has been merged into Broken Access Control, which stays at number one. Security Misconfiguration rose from fifth to second, and two categories were renamed: Authentication Failures and Security Logging and Alerting Failures.

No. The OWASP Top 10 is voluntary guidance, not a law, regulation or certification. However, it is widely treated as a baseline: customers, security questionnaires, contracts and penetration test scopes often ask organisations to show that their web applications are designed and tested against it. Some other standards and their guidance also point to it as an example of industry secure coding practice.

No. There is no official OWASP Top 10 certification, and the OWASP Foundation does not certify organisations or products against it. Organisations show alignment instead through secure development policies, developer training, code review, automated security testing and independent application penetration testing that reports findings against the ten categories. For a more detailed, testable set of requirements, OWASP recommends its Application Security Verification Standard (ASVS).

You align with the OWASP Top 10 by building its prevention guidance into how you design, build and test software. In practice that means secure coding standards, threat modelling, strong access control and authentication, hardened configuration, dependency and supply chain management, logging with alerting, and safe error handling. Test applications regularly, fix findings, and keep evidence of each step so you can show customers and auditors your coverage.

The OWASP Top 10 complements ISO 27001 and SOC 2 rather than replacing them. ISO 27001 Annex A includes secure development and secure coding controls, and SOC 2 assesses change management and system security, and teams often use the OWASP Top 10 as the practical reference for meeting those controls in web applications. Evidence such as secure development policies and penetration test reports can support all three.

Broken Access Control (A01:2025) remains the most serious category in the 2025 edition, as it was in 2021. OWASP's data shows that on average 3.73% of tested applications had one or more of the 40 weaknesses in this category. It covers flaws that let users act outside their intended permissions, and from 2025 it also includes Server-Side Request Forgery (SSRF).

Yes, on request. The OWASP Top 10:2025 is mapped in OneClickComply's control library and is available on request rather than enabled by default. Once added, your controls and evidence are linked to each of the ten categories, so work you already do for frameworks such as ISO 27001 or SOC 2 counts towards it. Our auditors and penetration testing service can help you show application-level coverage.