OWASP Top 10:2025 — What Changed From 2021
Reviewed: 2 August 2026 — verified against owasp.org, re-checked quarterly
Quick Answer
OWASP Top 10:2025 introduces two new categories — Software Supply Chain Failures and Mishandling of Exceptional Conditions — and consolidates SSRF into Broken Access Control. Security Misconfiguration rose from #5 to #2. Most other categories kept their scope with minor renames (e.g. Authentication Failures, Security Logging & Alerting Failures) and reordered rankings.
How Many Categories Actually Changed?
Per OWASP's own release notes, there are two new categories and one consolidation in the 2025 edition. Software Supply Chain Failures (A03:2025) is new — an expansion of 2021's "Vulnerable and Outdated Components" to cover risks across the whole dependency, build and distribution ecosystem. Mishandling of Exceptional Conditions (A10:2025) is also new, covering improper error handling and logical/fail-open flaws. The consolidation: Server-Side Request Forgery, a standalone category in 2021, has been rolled into Broken Access Control for 2025.
The remaining seven categories carry over with the same or very similar scope, though several changed rank as the underlying testing data (from roughly 2.8 million tested applications) shifted, and two picked up minor renames to better reflect the CWEs each category now groups.
Full Category-by-Category Mapping: 2025 vs 2021
| 2025 | 2021 equivalent | What changed |
|---|---|---|
| A01:2025 Broken Access Control | A01:2021 Broken Access Control | Stays #1. SSRF (2021 A10) has been rolled into this category. |
| A02:2025 Security Misconfiguration | A05:2021 Security Misconfiguration | Rises from #5 to #2 — misconfigurations are more prevalent in the 2025 dataset as more application behaviour is config-driven. |
| A03:2025 Software Supply Chain Failures | A06:2021 Vulnerable and Outdated Components | New, broader category — expands 2021's "Vulnerable and Outdated Components" to cover the wider software dependency, build-system and distribution supply chain. Voted a top community concern. |
| A04:2025 Cryptographic Failures | A02:2021 Cryptographic Failures | Falls from #2 to #4, but the category itself is unchanged in scope. |
| A05:2025 Injection | A03:2021 Injection | Falls from #3 to #5, keeping its position relative to Cryptographic Failures and Insecure Design. |
| A06:2025 Insecure Design | A04:2021 Insecure Design | Falls from #4 to #6 as Security Misconfiguration and Software Supply Chain Failures overtake it — OWASP notes industry improvement in threat modelling since 2021. |
| A07:2025 Authentication Failures | A07:2021 Identification and Authentication Failures | Stays #7, renamed slightly (dropped "Identification") to better reflect the category's CWEs. |
| A08:2025 Software or Data Integrity Failures | A08:2021 Software and Data Integrity Failures | Stays #8, minor name change ("and" → "or"). |
| A09:2025 Security Logging & Alerting Failures | A09:2021 Security Logging and Monitoring Failures | Stays #9, renamed from "Monitoring" to "Alerting" to emphasise that logging without alerting has limited security value. |
| A10:2025 Mishandling of Exceptional Conditions | A10:2021 Server-Side Request Forgery (SSRF) | New category, replacing SSRF as a standalone entry (SSRF is now folded into Broken Access Control). Covers improper error handling, logical errors and fail-open scenarios. |
Source: OWASP Top 10:2025, "What's changed in the Top 10 for 2025" — owasp.org/Top10/2025.
Our penetration tests and Vulnerability Assessments cover the underlying vulnerability classes regardless of which Top 10 edition a report references them against. See our security testing glossary for CVE, CWE and CVSS definitions.
Talk to Us About Testing