WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2026 Europe • Jul 9, 2026 • Session details

Bulletproof Web Applications: The 2025 OWASP Top Ten

Christian Wenz

Delaying dependency updates by 48 hours can save your web app from zero-day malware. Master this and other game-changing architectural defenses from the 2025 OWASP Top Ten.

Pause
Mute Enter Fullscreen
#1 about 7 min

Overview of the 2025 OWASP Top Ten list

Understanding the core purpose and structural changes of the updated web application security awareness document.

#2 about 2 min

Preventing broken access control and mass assignment

How parameter manipulation and automatic model binding lead to unauthorized data modification.

#3 about 2 min

Addressing security misconfiguration via HTTP headers

Securing web applications effortlessly by configuring strict referral policies and browser security headers.

#4 about 2 min

Mitigating risks in the software supply chain

Balancing immediate vulnerability patching with delayed dependency updates to avoid malicious package versions.

#5 about 5 min

Fixing cryptographic failures by enforcing encrypted transport

Protecting data in transit by fully adopting strict transport security and secure cookie flags.

#6 about 2 min

Handling modern injection flaws and cross-site scripting

Defeating JavaScript injection attacks through proper output escaping and strict content security policies.

#7 about 3 min

Addressing insecure design through early threat modeling

Implementing security from the start by utilizing reference architectures and shifting security practices left.

#8 about 2 min

Securing token signatures and preventing authentication failures

Avoiding critical authentication flaws by using strong cryptographic secrets and secure session management patterns.

#9 about 2 min

Maintaining software and data integrity during execution

Protecting runtime execution against tampering by strictly verifying data types and utilizing subresource integrity hashes.

#10 about 2 min

Establishing active processes for logging and alerting

Transforming passive log collection into proactive security monitoring by implementing automated anomaly detection and escalation chains.

#11 about 2 min

Securing applications against exceptional condition mishandling

Preventing sensitive information leakage and resource exhaustion by properly managing application exceptions and stack traces.

#12 about 1 min

Identifying missing security risks beyond the top ten

Evaluating additional emerging threats like artificial intelligence prompt injection and excessive resource consumption vulnerabilities.

#13

Fixing model mass assignment vulnerabilities in code

Remediating unauthorized data binding using dedicated view models or private property setters.

Matching moments

12:11 min

Identifying and mitigating top software vulnerability classes

Thomas Konrad · World Congress 2021

1:38 min

Overview of the OWASP API security top ten

Christian Wenz Christian Wenz · World Congress 2025

1:08 min

Overview of the OWASP MCP top ten vulnerabilities

Jose Manuel Ortega Jose Manuel Ortega · Europe 2026 Virtual

48 sec

Overview of five common software security pitfalls

Alexander Pirker · World Congress 2022

1:28 min

Identifying common security vulnerabilities via the OWASP project

Ramona Schwering Ramona Schwering · World Congress 2024

6:43 min

Implementing seven essential steps for modern web security

Bartosz Pietrucha · JS Congress

More from World Congress 2026 Europe

Building the Nervous System of AI - Michael Kagan (NVIDIA) thumbnail
29:17
2 months ago

Building the Nervous System of AI - Michael Kagan (NVIDIA)

Michael Kagan, Sead Ahmetović

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote thumbnail
19:41
2 months ago

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote

Christian Heilmann

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend thumbnail
32:06
2 months ago

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend

David vonThenen

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes thumbnail
35:13
2 months ago

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes

Irina Branovic

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬 thumbnail
24:23
2 months ago

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬

Jeremy Murray

Angstfreude - AI and Corporate Culture - The Thrill and the Threat thumbnail
30:26
2 months ago

Angstfreude - AI and Corporate Culture - The Thrill and the Threat

Axel Ebert, Karin Krobath

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 24, 2026 · 14:50–15:20

Stage 1

The Era of Machine-Driven Defense is Here: Headless Security

Loris Degioanni

Founder & CTO of Sysdig

Loris Degioanni
Open session

World Congress 2026 North America

September 25, 2026 · 09:40–10:10

Stage 5

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

September 25, 2026 · 16:50–17:20

Stage 5

The Things Your AI Isn't Telling You

Desmond Lamptey

Lead Software Engineer at Capital One

Desmond Lamptey
Open session

World Congress 2026 North America

September 24, 2026 · 16:10–16:40

Stage 7

Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026

Farshad Abasi

CEO/Founder, Eureka DevSecOps + Forward Security

Farshad Abasi
Open session

World Congress 2026 North America

September 23, 2026 · 15:45–17:45

Stage 10

Securing the Agentic Stack: Docker Hardened Images and Supply Chain Security

Ajeet Raina

Developer Advocate at Docker

Ajeet Raina
Open session

World Congress 2026 North America

September 24, 2026 · 16:00–18:00

Stage 13

Practical Threat Modeling for Software Developers

Mudassir Syed

Lead Security Software Engineer

Mudassir Syed

Related videos

Bullet-Proof APIs: The OWASP API Security Top Ten thumbnail
25:46
World Congress 2025 • about 1 year ago

Bullet-Proof APIs: The OWASP API Security Top Ten

Christian Wenz

Security in modern Web Applications - OWASP to the rescue! thumbnail
26:59
World Congress 2023 • almost 3 years ago

Security in modern Web Applications - OWASP to the rescue!

Jakub Andrzejewski

Software Security 101: Secure Coding Basics thumbnail
1:58:48
World Congress 2021 • about 5 years ago

Software Security 101: Secure Coding Basics

Thomas Konrad

101 Typical Security Pitfalls thumbnail
28:41
World Congress 2022 • over 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski thumbnail
38:44
Coffee With Developers • 7 months ago

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Bozidar Spirovski, Wekoslav Stefanovski

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together thumbnail
23:34
World Congress 2022 • over 4 years ago

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together

Stefania Chaplin

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.