OWASP Top 10 2025: What's changed and why it matters
Jan 7, 2026Fernando Diaz
Summary
This post details the OWASP Top 10 2025 list, highlighting two new categories: A03: Software Supply Chain Failures and A10: Mishandling of Exceptional Conditions. It explains how GitLab Ultimate's security scanning features (SAST, IaC scanning, Secret Detection, Dependency Scanning, DAST, API Security Testing, Web API Fuzz Testing) address these and other OWASP categories. It also mentions the integration of AI agents like the Security Analyst Agent for vulnerability triage.
More from the Security Control Framework trail
- Track organization-wide security risk in one dashboard
- Dependency Firewall: Block risky packages before the build
- Two front doors: Module-level access in a Django GRC app
- How GitLab tracks vulnerabilities through refactors and reformatting
- Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting