Every few years the OWASP Top 10 gets a refresh, and every few years the same conversation happens on security teams: "did anything actually change, or did they just reorder the list?" The honest answer for the current version is a bit of both — the category names are mostly familiar, but what falls inside each one has moved.
Access control is still winning, for the wrong reasons
Broken access control has topped the list for several cycles now, and in our own engagements it remains the single most common high-severity finding. What's changed is the shape of it: fewer simple "forgot to check the role" bugs, more subtle object-level authorization gaps in APIs — a user can reach an endpoint they're allowed to call, but the object ID in the request isn't checked against who they actually are.
Supply chain risk keeps climbing
Vulnerable and outdated components used to be the category everyone skimmed past. It's not skippable anymore. A meaningful share of the code running in a typical web app today is a dependency your team didn't write and probably hasn't read, and that surface keeps growing every time a new package gets pulled in for a small convenience.
What this means for testing
- Object-level authorization deserves its own dedicated test pass on every API endpoint, not a spot check.
- A dependency inventory is no longer optional — you can't assess risk you haven't catalogued.
- Business-logic flaws still don't show up in any checklist. They only show up when someone tries to break your actual workflow.
None of this means the fundamentals changed. It means the fundamentals got more specific, and testing has to follow.