OWASP Top 10:
the ten risks, explained in practice

The OWASP Top 10 is not a list of vulnerabilities but a list of risk <em>categories</em>, updated periodically from data across tens of thousands of applications. It is the reference most contracts and compliance frameworks cite when they say "testing per a recognised methodology". This guide walks the 2021 edition — the one in general use — and shows, for each category, what is actually checked in a test.

A01 — Broken Access Control

First place, and the most consistent source of real incidents. The application verifies who you are but not whether you are allowed to perform the exact action requested. In practice: change an identifier in the URL and see another customer’s invoice; call an admin endpoint directly that the interface never shows you; modify a role field in a request and become an administrator. No scanner catches these, because it does not know who should see what.

A02 — Cryptographic Failures

Sensitive data transmitted or stored without adequate protection: traffic over HTTP, passwords stored with outdated algorithms, keys in source code, card data or identity documents kept in the clear "temporarily". The category was previously called "sensitive data exposure", and the rename is useful: the problem is not only exposure but choosing the wrong protection mechanism.

A03 — Injection

User-supplied data reaches an interpreter without separation: SQL, system commands, LDAP, XPath, server-side templates. It also includes cross-site scripting, moved here in the 2021 edition. This is the category automated tools cover best — which is precisely why, in a manual test, attention goes to the variants tools miss: second-order injection, unusual contexts, filters that can be bypassed.

A04 — Insecure Design

A category introduced in 2021 and the hardest to automate: the application does exactly what it was designed to do, and the design is the problem. A password recovery flow resting on a publicly known answer, a refund limit missing from the logic, an order process that can be replayed. There is no signature to detect here — only someone who understands the business and tries to misuse it.

A05 — Security Misconfiguration

Default accounts left active, error messages revealing internal structure, exposed admin services, overly broad cloud permissions, debug features left on in production. It is the category with the best ratio between remediation effort and risk removed — and, in most tests, the source of the first way in.

A06 — Vulnerable and Outdated Components

Libraries, frameworks and services with known, published vulnerabilities. The category best solved by automation: a dependency inventory and a recurring check resolve most cases. The real difficulty is not detection but updating — an old dependency woven deep into the code becomes a project, not a patch.

A07 — Identification and Authentication Failures

Weak passwords permitted, no attempt limiting, sessions that never expire, predictable tokens, account recovery that can be abused, multi-factor authentication bypassable through an alternative flow. The last case appears more often than expected: MFA on the web interface but not on the mobile API.

A08 — Software and Data Integrity Failures

Code or data accepted without verifying provenance: unsigned automatic updates, libraries pulled from uncontrolled sources, deserialisation of user-supplied objects, delivery pipelines where anyone can inject an artefact. This is the category matching supply chain attacks — which is why NIS2 and the legislation aligned to it treat it separately.

A09 — Security Logging and Monitoring Failures

The category that never causes a breach on its own but decides how long it lasts. Unlogged security events, logs kept only locally and wiped by the attacker, alerts reaching nobody, no way to reconstruct what happened. In a test it is measured simply: at the end, the team is asked what it noticed — and the answer says more than the findings list.

A10 — Server-Side Request Forgery (SSRF)

The application takes a user-supplied address and fetches it itself. The attacker points it at the internal network or the cloud provider’s metadata service and thereby reaches things it cannot touch directly. It entered the Top 10 in 2021 precisely because cloud architectures increased its impact: a single well-chosen request can return credentials.

What automation catches and what needs a human

Frequently asked questions

Related guides

• What a pentest costs — what drives the price, how effort is estimated, and what makes two quotes comparable.
• DORA & TLPT — digital operational resilience in finance and threat-led penetration testing.
• ISO 27001 & SOC 2 — which controls require technical testing and what evidence the auditor accepts.
• Moldova’s Law 48/2023 — the national cybersecurity framework: who is in scope and what obligations it brings.
• PCI DSS 4.0 — requirements 11.3 and 11.4, segmentation testing, and what it means for payment processors.
• Pentest vs vulnerability scanning — what each one finds, what it misses, and what auditors accept as evidence.
• How to prepare for a pentest — scope, access, rules of engagement and everything settled before day one.

This material summarises the 2021 edition of the OWASP Top 10 for information. The list is updated periodically by OWASP; check the edition in force when citing it in a contract or an audit file.