SECNET / FIELD GUIDE · Engineering

OWASP Top 10:2025 — ten risks, ten evidence questions

OWASP Top 10:2025 is an awareness reference, not a complete test standard or a certification. The ten cards below pair the official category names with original SecNet lab questions and closure evidence. Use a versioned ASVS requirement set and relevant WSTG tests to build coverage beyond these categories.

SecNet learning series · 1.0 · Source check: 2026-10-11

Original SecNet educational content. Examples are fictional; this is not a publication or endorsement by the referenced organizations.

Ten colorful exhibits represent application risk themes, from access control to monitoring.
Original AI-assisted educational illustration; not an incident photograph or technical architecture.
SECNET / VISUAL LAB · WEB / APPSEC

Web security · a request under inspection

Follow a request through distinct control points. Select a case to see where it stops.

INTERACTIVE
BrowserTLS / edge filterSessionObject permissionInput validationData operation
01 / 06 · Browser

The illustrated request passes each check. An edge filter does not replace application authorization.

Show process diagram
Risk → Rule → Test → Evidence → Closure
A summary of the workflow; detailed steps follow below.

How to plan and execute

  1. Identify the release and business workflows being assessed; record third-party and inherited controls separately.
  2. Map each relevant risk to assets and a testable security rule, not simply a checkbox with the category name.
  3. Choose synthetic positive and negative cases at the actual server or trust boundary. Obtain authorization before dynamic testing.
  4. Validate tool alerts and document exploitability prerequisites, affected build and redacted evidence.
  5. Assign remediation to code or platform owners; review shared root causes when several categories point to one architectural defect.
  6. Retest with the original failing case plus a permitted neighboring case. Preserve untested coverage and residual risk explicitly.

Tools & work records

  • Semgrep — selected code rules supporting specific hypotheses, followed by manual validation.
  • Trivy — release artifact and dependency evidence for supply-chain review.
  • ZAP — permitted dynamic web checks; business logic and authorization require additional designed tests.

What reports are produced?

  • Risk-to-control coverage matrix with the OWASP edition.
  • Validated technical findings and release-specific evidence.
  • Remediation/retest register and gaps beyond Top 10.

OWASP Top 10:2025

Official category names with original test questions and closure evidence:

A01:2025

Broken Access Control

Can a test tenant access another tenant’s synthetic report? Enforce object authorization at the service boundary. Closure evidence includes denied cross-tenant and allowed owner requests.

OWASP ↗
A02:2025

Security Misconfiguration

Does the deployed environment expose a diagnostic route or broad storage permission? Compare intended configuration with runtime evidence. Recheck the deployed revision after the change.

OWASP ↗
A03:2025

Software Supply Chain Failures

Can the team explain each dependency and how it enters the release? Review provenance and update controls. Compare the approved inventory with the shipped artifact and document unresolved sources.

OWASP ↗
A04:2025

Cryptographic Failures

Who can decrypt an exported backup, and how are keys rotated? Trace access across the actual storage/key boundary. Evidence should demonstrate approved decryption and rejected unauthorized access.

OWASP ↗
A05:2025

Injection

Does a synthetic input become executable query or markup? Prefer parameterized data handling and context-appropriate output encoding. Record the affected sink and a regression test, not just input filtering.

OWASP ↗
A06:2025

Insecure Design

Can a user skip a required approval transition? Model valid states and invariants before adding UI restrictions. Test the forbidden transition at the backend with a synthetic workflow.

OWASP ↗
A07:2025

Authentication Failures

Does password reset or logout invalidate the intended session? Test the lifecycle using authorized test identities. Evidence includes rejected stale sessions and successful new authentication without revealing tokens.

OWASP ↗
A08:2025

Software or Data Integrity Failures

Can an altered artifact or message be accepted as trusted? Define the integrity boundary and verify it before use. Test rejection of a modified synthetic artifact and acceptance of the approved one.

OWASP ↗
A09:2025

Security Logging and Alerting Failures

Does a denied privileged action reach the response team with useful context? Exercise logging and alert routing end to end. Preserve the event-to-alert evidence while excluding secrets and unnecessary personal data.

OWASP ↗
A10:2025

Mishandling of Exceptional Conditions

What happens when a dependency times out halfway through a transaction? Specify safe failure and resource limits. Exercise the synthetic failure and verify that partial state, repeated attempts and cleanup respect the business invariant.

OWASP ↗
FICTIONAL WORKED EXAMPLE

Connect the decision to evidence

Fictional review: an authorization bug and a missing alert are separate questions. Fixing object ownership does not prove alert routing works. Give each control its own evidence and closure condition; use the cards below to discuss ownership with engineering, platform and response teams. A “Top 10 compliant” claim would overstate what this exercise establishes.

Closure check

  • Category labels and report edition both say 2025?
  • Every relevant category has a testable rule and evidence?
  • Coverage beyond awareness categories considered?
Download report workpaper (.md) ↓

Official sources

Use these sources for criteria, tools and regulations; verify applicability and version for the actual assessment.