The OWASP Top 10 is the most widely referenced list of critical web application security risks. It's written for developers, but the impact of these flaws lands squarely on the business. Here's what the main categories mean in plain terms.
Broken access control
Users can do or see things they shouldn't, like viewing another customer's invoice by changing a number in the URL. It's consistently among the most common serious findings in real-world testing, and it often leads directly to data breaches.
Cryptographic failures
Sensitive data is not properly protected in transit or at rest: weak encryption, missing HTTPS, or passwords stored in a recoverable way. The result is exposed personal or financial data.
Injection
Untrusted input is treated as a command, as in SQL injection or cross-site scripting. Attackers can read or modify your database, or run code in your users' browsers.
Insecure design
The flaw is in the logic itself, not the code. A password reset flow that can be abused, or a discount that can be applied unlimited times. Only thinking like an attacker at the design stage catches these.
Security misconfiguration
Default credentials, verbose error messages, open cloud storage and unnecessary features left enabled. These are simple mistakes with outsized consequences.
Vulnerable and outdated components
Modern applications are built on open-source libraries. If those aren't kept up to date, you inherit their known vulnerabilities.
Authentication failures
Weak login protections, such as no multi-factor authentication, no rate limiting and poor session handling, make account takeover easy.
Integrity, logging and SSRF
The remaining categories cover untrusted updates and pipelines, insufficient logging to detect attacks, and server-side request forgery, where your server is tricked into making requests on an attacker's behalf, often into internal cloud services.
Questions to ask your team
When did we last have an independent security test of our key applications?
How do we check that users can only access their own data?
How quickly do we patch vulnerable dependencies?
Would we know if someone were attacking us right now?