A09: logging without alerting is worth little
Security Logging and Alerting Failures holds #9, renamed from *Logging and Monitoring Failures* to stress the alerting half. The project's own words: great logging with no alerting is of minimal value in identifying security incidents.
Why it is like this
Monitoring describes a capability; alerting describes something happening. The rename moves the bar from "we collect logs" to "somebody is told".
Not to be confused with
Underrepresented because it is unimportant. It has only around 723 CVEs and is incredibly difficult to test for — the project says the category will always be underrepresented in the data, which is why the survey keeps voting it back in.
In practice
Its weaknesses include inserting sensitive data into logs and failing to encode output written to them — so the category cuts both ways: too little logging, and logging the wrong thing.
Source: OWASP Top 10:2025 — A09:2025 Security Logging and Alerting Failures. Read on .
The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.
Predict Check yourself
A team centralises all security logs with 400 days of retention and no alert rules. Where does A09 leave them?
Show the answer
Still squarely in the category — the 2025 rename exists to say that logging nobody is alerted by has minimal value for identifying incidents.
This is precisely the gap the rename from Monitoring to Alerting was made to close.