Security
OWASP Top 10:2025
Two new entries, four renames, and injection is not where you left it
The 2025 list moved enough that anyone who learned the 2021 one is now wrong in several places. What each category actually covers, how the ranking is built, and the three ways the list gets misused.
Start the map 6 pillars · 18 cards · about 27 minutes end to end
The map
Five minutes, once. Rate each pillar before you start and the cards you are shakiest on come first. Skipping it costs you nothing but the ordering.
-
What the list is
A risk-awareness document built from data and a survey — not a standard, and not a list of bugs.
-
What is new in 2025
Two new categories, one consolidation, and four names that changed under people.
-
Access, configuration and identity
The top two, and the one that has not moved in four years.
-
The classics, demoted
Crypto, injection and insecure design all fell — and none of it means they are solved.
-
Integrity and operations
The categories about what happens after the code is right.
-
How the list gets misused
Three claims people make with it that it does not support.
Apply it
One scenario per sitting, about ten minutes. No marking scheme that pretends to be objective — a rubric you are invited to argue with.
Read against OWASP Top 10:2025 on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.
The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.