A01

Broken Access Control

A01

Broken Access Control

Still the #1 risk. Authorization issues remain widespread, and SSRF is now treated as a symptom of broken access control.

A02

Cryptographic Failures

A04

Cryptographic Failures

Still important, but not growing as fast as misconfigurations or supply-chain risks.

A03

Injection

A05

Injection

Modern frameworks reduce many injection flaws, but high-impact cases like SQLi and RCE still matter.

A04

Insecure Design

A06

Insecure Design

“Secure by design” is no longer aspirational — it’s now expected as a baseline engineering practice.

A05

Security Misconfiguration

A02

Security Misconfiguration

Now a top-tier risk (#2). Misconfigurations in web applications, cloud environments, containers, and APIs drift easily — and continue to cause real-world breaches.

A06

Vulnerable & Outdated Components

— → Replaced by →

A03 — Software Supply Chain Failures (New)

Much broader scope now: includes dependency trust, package integrity, CI/CD pipeline security, and distribution chain risks.

A07

Identification & Authentication Failures

A07

Authentication Failures

Renamed for clarity. Credential-stuffing, weak session handling, and token misuse remain common.

A08

Software & Data Integrity Failures

A08

Software or Data Integrity Failures

Emphasizes verifying integrity of code, data, files, and artifacts. Same category, clearer focus.

A09

Logging & Monitoring Failures

A09

Logging & Alerting Failures

Logging alone isn’t enough — lack of actionable alerts remains a major detection weakness.

A10

SSRF

Merged into

A01 & A02

SSRF is now viewed as a by-product of poor access control and insecure configuration.

—

—

A03 (New)

Software Supply Chain Failures

Captures modern attack patterns (SolarWinds, dependency poisoning, artifact tampering). A major new focus area.

—

—

A10 (New)

Mishandling of Exceptional Conditions

Addresses failure modes: error handling, fail-open behaviour, degradation handling, and operational resilience.

A01 – Broken Access Control

Detects abnormal access patterns, blocks forced browsing, authorization bypass attempts, and SSRF-like traffic flows.

A02 – Security Misconfiguration

Enforces secure headers, strict TLS policies, sane defaults, and prevents exposure from misconfigured web apps, APIs, and gateways.

A03 – Software Supply Chain Failures

Monitors runtime anomalies from compromised components, malicious libraries, or unexpected behaviour injected into the app.

A05 – Injection

Blocks payloads for SQLi, XSS, NoSQLi, command injection (RCE), template injection, and deserialization attacks.

A07 – Authentication Failures

Detects credential stuffing, brute-force login attempts, session manipulation, and MFA bypass attempts.

A09 – Logging & Alerting Failures

Sends enriched events to SIEM/SOAR, enabling timely incident detection and automated responses.

A10 – Mishandling of Exceptional Conditions

Prevents applications from leaking data or failing open when backends crash or misbehave (e.g., 500/502/503 scenarios).

1

Audit access-control logic and privilege boundaries — especially across APIs, microservices, and backend integrations.

2

Strengthen configuration governance for cloud, container, proxy, gateway, and WAF layers.

3

Inventory third-party dependencies and enforce SBOM + integrity checks across build pipelines.

4

Validate cryptographic configurations, key rotation, and certificate lifecycle management.

5

Enable WAF behavioural detection and runtime protection modes for layered defense.

6

Ensure logs trigger alerts, tickets, or automated actions — not just storage.

7

Test system behaviour under failure, not just under normal load — resilience is now a security requirement.