What’s New in OWASP 2025: Configuration Drift, Supply Chain Risk, and Continuous Testing

OWASP Top 10 2025: Moving Beyond Code

Every few years, the Open Web Application Security Project (OWASP) updates its Top 10 list, the industry’s go-to list of the most critical web application risks. But the 2025 update does more than reshuffle rankings. It reflects a fundamental shift in how modern applications fail. Security isn’t just about code flaws anymore. It’s about systems, configurations, and dependencies that change faster than teams can keep up.  

Two trends stand out in this release: Security Misconfiguration surged three spots up the list, and Software Supply Chain Failures entered with a broader scope than ever before. Together they point to a reality every organization is living: our environments are dynamic, our tooling is interconnected, and risk is increasingly introduced by change itself.  

Security Misconfiguration: The Fastest-Rising Risk 

Security Misconfiguration’s climb in OWASP’s 2025 Top 10 says more about today’s environments than yesterday’s vulnerabilities. Misconfiguration has become the default failure mode of modern infrastructure.  

Cloud platforms, containers, and APIs have made deployment easier, but they’ve also multiplied the number of places something can quietly go wrong. A missing “deny” rule, an overly permissive IAM policy, or a forgotten debug flag from the staging environment can all create exposure overnight. And while vulnerability scanners are good at finding known CVEs, they rarely understand context or how a small misconfiguration might chain into a real-world exploit path.  

That’s why configuration drift has become one of the biggest blind spots in application security. Even well-hardened systems drift over time as updates roll out or automation shifts. What was secure last quarter may be vulnerable today, and most teams won’t know until an attacker does.  
 

“Unlike CVEs, misconfigurations aren’t addressed with a point-in-time patch. They’re issues that have the potential to be introduced repeatedly. Misconfigurations don’t even need a CVE number to ruin your week; they’re like mini-zero-days. Continuous pentesting helps to address that because we’re always on.” - Nick Berrie, Senior Penetration Tester at Sprocket Security 
 

Continuous Penetration Testing (CPT) closes that gap. Unlike periodic testing or static scanning, continuous pentesting keeps eyes on your environment as it changes. It surfaces new misconfigurations, validates exploitability, and prioritizes what matters based on how attackers would actually use it. The result is not another pile of alerts but a real-time view of your security posture that evolves as fast as your infrastructure.  
 

Software Supply Chain Failures: Beyond Your Own Code 

OWASP’s 2025 update doesn’t just look deeper into your application. It looks around it. The new Software Supply Chain Failures category expands the traditional view of vulnerability. It acknowledges that security today isn’t only about your codebase. It’s about the ecosystem your software depends on.  

From open-source libraries to CI/CD integrations, third-party APIs, and container images, modern applications rely on a network of dependencies maintained by others. Each one is a potential weak link. A vulnerable package version, a compromised dependency, or an exposed build pipeline can all introduce risk without a single line of new code being written.  

Traditional security checks often stop at dependency scanning or SBOM reviews. Those can only tell you what’s there, not how it can be exploited. CPT takes it a step further by testing the full, assembled system as an attacker would. It defines exploitable chains created by a dependency flaw combined with a misconfiguration. Exactly the kind of multi-layered exposure OWASP now emphasizes.  

The shift in OWASP’s language reflects a broader truth: software isn’t built in isolation anymore, and neither are its vulnerabilities. The attack surface now includes your build tools, your deployment pipeline, and the vendors who ship your dependencies. The question isn’t whether you use third-party components, but whether you can see when one becomes an entry point.  
 

“OWASP 2025 acknowledges what real-world testing has shown for years; your biggest risk might not live in your code, but in everything connected to it.” - Greg Anderson, Lead Solutions Engineer at Sprocket Security  
 

OWASP as a Starting Point, Not a Strategy 

The OWASP Top 10 remains one of the most valuable frameworks in application security. It gives teams a shared language for identifying and prioritizing risk. But it’s not meant to be a strategy. It’s a map, not the terrain. Real-world attackers don’t limit themselves to ten categories, and they don’t wait for your next scan or audit to adapt.  

Organizations that treat OWASP as a checklist often fall into a compliance rhythm: patch, scan, report, repeat. It looks productive on paper, but it leaves a dangerous assumption untested: does yesterday’s validation still apply today? Environments change constantly, and those changes can quietly undo hardening steps or reintroduce old risks.  

Continuous Penetration Testing (CPT) operationalizes OWASP’s intent. Instead of checking for known categories of risk once a year, it continuously tests for how those risks manifest in your environment right now. It reveals misconfigurations that open exploitable paths, dependencies that introduce new exposure, and patterns of drift that compliance reports can’t see.  

For security leaders, this approach transforms OWASP from a static reference into a living metric. One that measures progress, not just presence.  
 

Test for How Systems Change, Not How They’re Built  

The OWASP Top 10 2025 makes one thing clear: the biggest risks aren’t static bugs in code. They’re the evolving conditions that make those bugs exploitable. Misconfigurations, dependency flaws, and ecosystem exposure all share one trait: they emerge over time. Static testing methods can’t keep up with that pace of change.  

CPT is how organizations adapt. It’s not a replacement for OWASP or vulnerability scanning, it’s the missing layer that turns awareness into resilience. By continuously validating how your environment actually behaves, you can spot configuration drift, supply chain exposure, and real-world attack paths before they become incidents.  

The result isn’t just better coverage but continuous assurance that your controls work when they’re needed most.  

See how Sprocket’s CPT solution helps detect configuration drift, dependency risk, and evolving exposure so you can turn OWASP’s guidance into ongoing, measurable security outcomes.