OWASP Top 10 testing means validating all 10 categories in the current 2025 edition manually. Security Misconfiguration jumped from fifth to second place. Two categories, Software Supply Chain Failures and Mishandling of Exceptional Conditions, were added. A scanner handles categories like Injection well. Broken Access Control and Insecure Design depend on business logic no scanner understands.
"OWASP-aligned" shows up in many Requests for Proposal (RFPs) and scan reports, and it might not carry the weight you’d assume. A scanner can confirm that an application has a category of weakness. But it can't confirm that the weakness is something an attacker could use.
OWASP Top 10 testing takes what a scanner flags and proves, category by category, whether it holds up under manual validation. The current edition is OWASP Top 10:2025, not the 2021 list still cited in many older reports and RFP templates. Our web application penetration tests are built around validating exploitability against the current list.
What Changed in the 2025 Update
Two changes matter most if you're still using the 2021 edition. Security Misconfiguration jumped from fifth to second place. This change reflects how much of modern application behaviour now depends on configuration rather than code. Two categories are new: Software Supply Chain Failures and Mishandling of Exceptional Conditions.
Server-Side Request Forgery (SSRF), which had its own category in 2021, has been folded into Broken Access Control for 2025. That's not a demotion. Access Control still sits at number one. It reflects that SSRF is, at its root, an access control failure; it’s a request reaching somewhere it shouldn't have been able to.
Where a Scanner Earns Its Keep
Some categories are genuinely well suited to automated tooling, and it's worth knowing which ones. Pretending otherwise wastes testing time better spent elsewhere.
Cryptographic Failures and Known Patterns Injection issues, like a SQL injection against an unparameterised query, tend to show up reliably in a well-configured scan.
That doesn't mean these categories need no manual attention. A scanner can miss injection points hidden behind custom parsing logic. It can also miss a cryptographic implementation that looks correct on the surface but fails under a specific edge case. What this means is that baseline confidence from automated testing is higher here than further down this list.
However, scanners are also famous for flagging issues falsely.
Where OWASP Top 10 Testing Does the Real Work
The OWASP Top 10 testing categories are where automated tools run out of judgement. Broken Access Control depends on business logic, for example, if a user can reach data or actions that belong to someone else. Scanners don’t understand your authorisation model well enough to test for it.
Insecure Design sits in the same bracket. It's not a coding flaw so much as a decision made earlier in the process. Pentesting it means understanding what the application is meant to do, then working out where that intent breaks down.
Authentication Failures often need the same manual eye, particularly around session handling and multi-step login flows. A scanner walks through these mechanically without noticing where the logic falls apart.
The Categories OWASP Rewrote, Not Just Reordered
The Software Supply Chain Failure category is probably the most under-tested right now. The tooling to test it well is still catching up with how the category was defined. It covers compromises across the whole dependency and build pipeline, not just outdated packages with known CVEs. That's a much broader thing to test for than a mere dependency scan.
Mishandling of Exceptional Conditions includes systems that fail open rather than closed, incorrect error handling, and logical errors. These issues tend to surface only when a tester deliberately pushes an application into unexpected states. Malformed input, unusual sequencing, and conditions that the original developer never tested for all count.
Security Misconfiguration, now at number two, spans everything from cloud settings to server headers. Its jump in ranking reflects how much surface area configuration now covers across a typical application.
Is OWASP Top 10 Testing the Same as a Web App Pentest
Not quite, and the distinction is important when you're scoping work. OWASP Top 10 testing is a structured guide to validate 10 specific categories of risk. A full web application penetration test uses that structure as a foundation. From there, it goes further into business logic specific to your application, the kind that doesn't map cleanly onto any single category.
Testing against the OWASP Top 10 gives you assurance against the most common, broadly applicable risks. It won't catch a flaw that's unique to how your specific application handles a specific workflow. That's usually where quality manual pentests locate the most damaging findings in a mature application.
Your Systems Deserve Up-to-Date Penetration Tests
Many reports still cite 2021 categories, even though the list has since been updated. Our testers use business logic in addition to validating against the OWASP Top 10:2025.
Let’s Discuss Your Web App Pentest (for Free)
Quick Answers on OWASP Top 10 Testing
Does OWASP Top 10 Testing Need Access to Source Code?
Not always. Black-box testing against a live application catches most categories, including Broken Access Control and Injection, without ever touching the codebase. SSCF is the exception. Validating it properly means seeing the dependency tree, not just the running app, so a hybrid approach usually covers more ground than either method alone.
What Is the Relationship Between the OWASP API Security Top 10 and OWASP Top 10 Testing?
They cover different surfaces. The general OWASP Top 10 addresses web application risk in broader terms. The OWASP API Security Top 10 instead targets issues specific to API design, such as object-level authorisation and excessive data exposure through endpoints.
Does Web Application Security Testing Ever Skip the OWASP Top 10?
It shouldn't. The OWASP Top 10 is a baseline, not a ceiling. A high-quality web application security testing engagement will use it as such. It then builds business-logic testing on top, rather than treating the list as the final goal.
Does a 2021-Era Report Still Have Value?
Some findings age well since categories like Injection and Cryptographic Failures are still there. However, a report built against the 2021 list will miss the two categories added in 2025. It also won't reflect how much Security Misconfiguration risk has grown since.
Make Sure Your Security Testing Stays Current
"OWASP-aligned" is a baseline, not a guarantee. We manually validate every 2025 category, digging into the complex business logic flaws that automated scanners consistently miss.
Speak to Our Web App Testers
Want to Read More?
- Strengthen your defence mechanisms by implementing these essential web app security best practices.
- Learn how our expert testers conduct comprehensive web application penetration tests to secure your unique business logic.
- Protect your email infrastructure from common vulnerabilities by reading our detailed SMTP security guide.
