You test for the OWASP Top 10 by mapping each category to the method that can actually find it. Dynamic scans cover misconfiguration, many injection probes and authentication weak spots. Access control, insecure design and supply chain failures need manual tests, code review and dependency checks. No single tool covers all ten.
The 2025 categories
The 2025 list is: A01 Broken Access Control, A02 Security Misconfiguration, A03 Software Supply Chain Failures, A04 Cryptographic Failures, A05 Injection, A06 Insecure Design, A07 Authentication Failures, A08 Software or Data Integrity Failures, A09 Security Logging and Alerting Failures, and A10 Mishandling of Exceptional Conditions.
Which method fits
This split is our practical view, not an OWASP statement.
| Category | Dynamic scan | Other methods |
|---|---|---|
| A01 Access control | Weak | Two-account tests, code review |
| A02 Misconfiguration | Strong | Config review |
| A03 Supply chain | None | Dependency and SBOM scanning |
| A04 Cryptographic failures | Partial (TLS, cookies) | Code and config review |
| A05 Injection | Good | Static analysis, code review |
| A06 Insecure design | None | Threat modeling |
| A07 Authentication | Partial | Manual login and reset tests |
| A08 Integrity | Weak | Pipeline and signing review |
| A09 Logging | None | Log review, alert drills |
| A10 Exceptional conditions | Partial | Fuzzing, error path tests |
Steps
- Pick the categories relevant to your app and mark who owns each.
- Run a baseline dynamic scan for A02, A04 and A05 probes.
- Run an authenticated active scan on staging for injection and session issues.
- Write two-account scripts for A01.
- Scan dependencies and generate an SBOM for A03.
- Hold a short threat modeling session per new feature for A06.
- Trigger a failed login or blocked request and check it appears in logs for A09.
- Send malformed input to key endpoints and confirm clean errors for A10.
Reporting
Report by category so product owners see coverage gaps. A category with no test is a finding of its own, because absence of results is not the same as absence of risk.
Try it yourself
Group the demo findings by Top 10 category and note which categories stay empty.
Click through it at your own pace, or open it full screen.
Quick check
Is the Top 10 a checklist for compliance?
It is an awareness list, not a complete standard. Use it to frame tests, then add requirements from a verification standard if you need depth.
Can one scanner cover the whole list?
No. Several categories involve design, process or dependencies that a running-app scan cannot see.
Where Safeguard fits
Safeguard offers dependency and SBOM scanning, reachability analysis and policies and gates that can block a pull request, so the libraries behind your app are checked alongside the app itself. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
