The OWASP Top 10 Gets Modernized | Endor Labs

What it is

A practitioner's commentary on the 2025 OWASP Top 10, drawn from the OWASP Global AppSec session in Washington, D.C. The page's main addition to the rankings is the prevention guidance it passes along for the top two categories, plus a few figures. It points readers to the full OWASP Top 10 for per-category score tables and mitigations, and to a slide deck from the D.C. event.

What to do

The page relays OWASP's prevention techniques for the top two categories.

Broken Access Control (#1):

• Deny by default.
• Centralize authorization.
• Apply rate limiting.
• Run effective monitoring and logging.

Security Misconfiguration (#2):

• Harden regularly.
• Check configurations regularly.
• Use credential scanners to find exposed secrets.
• Disable unnecessary features.

The presenters said leaked credentials are the top security misconfiguration, so a secrets scanner is the first priority in that list. They also said misconfiguration is the #1 category for cloud and infrastructure security.

Software Supply Chain Failures (#3): The page names OWASP's Secure Pipeline Verification Standard (SPVS) as a framework for assessing the security maturity of delivery pipelines. It also lists AI-specific supply chain risks:

• LLM-hallucinated package names that attackers then register ("slopsquatting").
• AI-generated code that pulls in outdated or vulnerable components.
• Vulnerabilities in AI coding assistants themselves. Cursor, Windsurf and Claude are named.

Caveats

• The page gives two access-control figures without reconciling them. One says 3.73% of tested applications had one or more CWEs in the category. The other quotes OWASP as saying 100% had "some form" of broken access control. Check the OWASP data before citing either.
• Misconfiguration is hard to track because it has no CVE-style identifiers. The author says "incorrect" is subjective, since a risky setting may be a deliberate business decision. Secure-configuration baselines such as CIS Benchmarks and DISA STIGs don't exist for many newer or less common products.
• The author says hardening stays with the end user until vendors adopt CISA's Secure-by-Default approach, where products ship hardened and come with "loosening" guides.
• OWASP credits the drop in Insecure Design partly to wider threat modeling and Secure-by-Design practice.
• The claim that AI-assisted SAST catches business-logic flaws and cuts false positives is described as hope and "early promising research", with no data cited.
• The author wrote a book on software supply chain security and works at a vendor in this space, so the framing leans that way.