The OWASP Top 10 Explained for UK Business Owners

The OWASP Top 10 explained for UK business owners

The OWASP Top 10 is a list published by the Open Web Application Security Project — a non-profit foundation dedicated to improving software security. Updated every few years based on data from thousands of security assessments, it represents the most critical security risks to web applications.

If a security professional mentions the OWASP Top 10 to you, they are referring to this list. Understanding what each item means in plain English — and whether your website is likely affected — is genuinely useful even if you are not technical.

1. Broken Access Control

This is now the number one risk, having moved up significantly in recent years. Broken access control means users can do things they should not be able to do — access other people's accounts, view restricted data, or perform actions reserved for administrators.

Examples: a customer changing the order ID in a URL and seeing someone else's order; a regular user accessing admin functions by changing a URL; a former employee whose account still works.

Likely affected if: your website has user accounts, order history, or any personalised content.

2. Cryptographic Failures

Previously called Sensitive Data Exposure, this covers failures to properly protect sensitive data through encryption. This includes transmitting data over HTTP instead of HTTPS, storing passwords in plain text, using outdated encryption algorithms, or exposing sensitive data in URLs.

Likely affected if: your site handles passwords, payment data, or personal information — which is almost every business website.

3. Injection

Injection vulnerabilities — including SQL injection, command injection, and others — occur when untrusted data is sent to an interpreter as part of a command or query. The most common is SQL injection, where an attacker manipulates a database query through a web form.

Likely affected if: your website has search boxes, login forms, contact forms, or any input that queries a database.

4. Insecure Design

This covers architectural flaws rather than implementation mistakes — security risks that arise from how an application is designed rather than how it is built. Rate limiting failures, missing business logic controls, and lack of defence in depth are examples.

This is harder to test for automatically and typically requires manual review.

5. Security Misconfiguration

The most commonly found issue in practice. Security misconfiguration includes: default credentials left unchanged, unnecessary features enabled, error messages that reveal too much information, missing security headers, cloud storage left publicly accessible.

Likely affected if: you have not specifically reviewed your security configuration — which is most websites.

6. Vulnerable and Outdated Components

Using software components — libraries, frameworks, plugins — with known vulnerabilities. The WordPress plugin ecosystem is the most common manifestation of this risk for UK small businesses.

Likely affected if: your website uses WordPress, Joomla, Drupal, or any CMS with plugins you have not kept updated.

7. Identification and Authentication Failures

Weaknesses in how your application confirms who users are. Weak passwords, missing multi-factor authentication, insecure session tokens, and credential stuffing vulnerabilities fall under this category.

Likely affected if: your website has user accounts with password-based login and no second factor.

8. Software and Data Integrity Failures

Failures to verify the integrity of software updates and data pipelines. This includes relying on plugins or libraries from untrusted sources, and CI/CD pipeline security.

9. Security Logging and Monitoring Failures

Not directly exploitable, but critical for detecting and responding to breaches. If your website does not log security-relevant events and alert on anomalies, breaches go undetected for months.

10. Server-Side Request Forgery (SSRF)

Added to the OWASP Top 10 in 2021 following significant real-world impact. SSRF allows attackers to make the server fetch data from internal systems that should not be accessible from the internet.

Likely affected if: your application fetches content from URLs provided by users — link previews, image imports, webhook configurations.

How Yrzo AI covers the OWASP Top 10

Yrzo AI's 44 automated checks are mapped to the OWASP Top 10 categories. The scan covers broken access control (IDOR testing), injection vulnerabilities (SQL injection, XSS, SSTI, command injection), security misconfiguration (headers, SSL, exposed files), outdated components (WordPress plugin detection), authentication failures (JWT testing, brute force protection), and SSRF. Starting at £399 with a full plain-English report in under 20 minutes.