OWASP Top 10: What's Changed and What Most Teams Still Miss

Every security framework, compliance checklist, and pen test report references the OWASP Top 10. It's the closest thing the industry has to a universal standard for web application security risks. But "covering OWASP Top 10" means different things to different teams — and in most cases, it means less than it should.

What the OWASP Top 10 actually is

The OWASP Top 10 is a ranked list of the most critical security risks to web applications, updated periodically based on data from hundreds of organizations. It's not a technical specification — it's a risk prioritization framework. Each category represents a class of vulnerabilities, not a single CVE.

The current list (2021, still authoritative as of 2026):

A01: Broken Access Control
A02: Cryptographic Failures
A03: Injection
A04: Insecure Design
A05: Security Misconfiguration
A06: Vulnerable and Outdated Components
A07: Identification and Authentication Failures
A08: Software and Data Integrity Failures
A09: Security Logging and Monitoring Failures
A10: Server-Side Request Forgery (SSRF)

The gap between "we cover OWASP" and actually covering it

A01: Broken Access Control moved from #5 to #1 because it's endemic — and because most automated tools don't catch it well. IDOR (Insecure Direct Object Reference) vulnerabilities require understanding your data model and testing cross-user requests. A scanner doesn't know which resource IDs belong to which users. An AI agent that authenticates as multiple users can.

A04: Insecure Design is the hardest category to test because it's about architectural decisions, not implementation bugs. No tool can find an insecure design in isolation. But agents that test multi-step flows, business logic, and rate limiting — and document what they find — create the evidence needed for design-level security reviews.

A09: Security Logging and Monitoring Failures is rarely tested at all. It's the only Top 10 category where the vulnerability is the absence of a control, not the presence of a flaw. Testing it requires attempting attacks and verifying whether they appear in your logs — something most security programs simply don't do.

What continuous testing changes

The most significant shift continuous testing enables is moving from a coverage question to a trend question. Instead of "did we test the OWASP Top 10 this quarter?", the question becomes "what's our remediation velocity across each category over time?"

That shift — from point-in-time assessment to longitudinal tracking — is where mid-size organizations can genuinely outperform larger ones. They can move faster, close vulnerabilities sooner, and demonstrate measurable improvement.