What Is Web Security? How to Protect Your Web Presence from Data Threats

Web security protects websites and web applications from attacks targeting data, access and infrastructure, guided by frameworks like the OWASP Top 10 that rank the most critical current risks. If you have been referencing an OWASP ranking from a few years back, a major new edition released recently changes several things most existing content hasn’t caught up to yet.

What Is Web Security?

Web security is the practice of protecting websites, web applications and the data they handle from unauthorized access, data theft, and attacks exploiting weaknesses in how a web application is built, configured or deployed. This spans everything from access control and input validation through to server configuration and how an application interacts with underlying cloud infrastructure.

Unlike network security’s broader focus, web security concentrates specifically on the application layer, the actual code, logic and configuration determining how a website or web application behaves, since this is precisely where attackers most commonly find the specific weaknesses letting them reach data they were never meant to access.

The OWASP Top 10: And the Current Edition Most Articles Get Wrong

Rank	2025 Category	Changed From 2021
A01	Broken Access Control	Remains #1, now includes SSRF
A02	Security Misconfiguration	Jumped from #5 to #2
A03	Software Supply Chain Failures	New, broadened category
A10	Mishandling of Exceptional Conditions	Brand new category

Here is something worth stating directly, since a huge share of current content online has not caught up to it. OWASP released its 2025 Top 10 in November 2025, the eighth edition and the first major revision since 2021. Any article still describing the “current” OWASP Top 10 using the 2021 rankings is describing an outdated framework, not the current one.

The genuinely significant changes matter directly for how you should think about web security priorities right now. Broken Access Control remains at number one, but its scope has expanded meaningfully, now explicitly absorbing Server-Side Request Forgery, which used to be its own separate category. Security Misconfiguration jumped dramatically from fifth place to second, reflecting how much complexity, cloud-native architecture, microservices, expanding APIs, has become a genuine driver of risk on its own. A brand new category, Software Supply Chain Failures, broadens what used to be a narrower focus on outdated components into a fuller reflection of dependency risk. Another entirely new category, Mishandling of Exceptional Conditions, addresses poor error handling that leaks data or fails open. If you are basing any current web security decision, a penetration test scope, a vendor evaluation, an internal training program, on the 2021 rankings specifically, you are working from a framework that no longer reflects OWASP’s own current, contributed testing data.

Broken Access Control: Why It’s Ranked the #1 Risk

Broken Access Control means an application fails to properly enforce what a specific, authenticated user is actually allowed to do or see, letting them access data or perform actions genuinely outside their intended permissions. This ranks first specifically because OWASP’s own contributed testing data found some form of it in effectively every application category tested, the single most consistently present risk category across the entire dataset.

This category covers a genuinely broad range of specific failures: allowing a user to view or edit someone else’s account by simply changing an identifier in a request, an API missing proper authorization checks on data-modifying requests, or a user gaining elevated privileges they were never meant to hold. Access control is notoriously difficult to test automatically, since a scanning tool cannot inherently know whether User A should genuinely have access to Record B, only the specific business logic of that particular application determines the correct answer, which is precisely why this category persists at the top despite being conceptually well understood for years.

SSRF: How a Web Application Vulnerability Can Hand Over Your Cloud Credentials

Server-Side Request Forgery lets an attacker trick a web application into making requests on the attacker’s behalf, often targeting internal systems or services the application itself can reach but the attacker could never access directly. Under the current 2025 OWASP edition, this vulnerability type is now formally categorized within Broken Access Control specifically, reflecting an expanded interpretation of access control that treats an application making unauthorized internal requests as fundamentally an access control failure.

Here is precisely why this matters so seriously in cloud environments specifically. Cloud platforms like AWS, Azure and Google Cloud all provide an internal metadata service, a special internal address a running application can query to retrieve temporary credentials and configuration information about the specific cloud resource it runs on. This metadata service is only meant to be reachable from within the application itself, never from an external user directly. SSRF exploits precisely this gap: an attacker manipulates a vulnerable application into making a request to that internal metadata address on their behalf, and the application, trusting its own internal network position, dutifully retrieves and often returns those credentials, credentials the attacker could never have requested directly themselves. Those retrieved credentials frequently grant meaningful access to the broader cloud environment beyond just the single compromised application, turning what started as a single web application flaw into a genuine cloud infrastructure compromise. This is precisely why SSRF deserves specific, standalone understanding beyond a generic “vulnerability” label, since the actual consequence, cloud credential theft through an application’s own trusted internal network position, is considerably more severe than the underlying mechanism might initially suggest.

Current Threats: What NCSC’s Latest Advisory Reveals About Hacktivist Attacks

NCSC’s own current guidance specifically names NoName057(16), a pro-Russian hacktivist group active since March 2022, as an ongoing threat to UK organizations, operating a crowdsourced platform called DDoSia that lets volunteers contribute computing resources toward coordinated attacks in exchange for rewards. An international law enforcement effort disrupted significant infrastructure tied to the group in mid-2025, yet NCSC’s subsequent bulletin confirms the group resumed activity, since its core operators are believed to be based in Russia, beyond the reach of that specific law enforcement action.

This matters directly for web security specifically because hacktivist-driven attacks increasingly target web-facing infrastructure directly, using exactly the kind of application-layer weaknesses covered throughout this guide alongside more traditional denial-of-service techniques. NCSC’s own bulletin notes this specific group is ideologically motivated rather than financially driven, describing it as an evolving threat now also affecting operational technology environments beyond typical web targets alone.

Two Free NCSC Services Most Businesses Don’t Know Exist

NCSC operates a free service called Mail Check, helping organizations assess and improve their email authentication configuration, DMARC, SPF and related protections, at no cost. A companion service, Web Check, provides similar free assessment specifically for web-facing infrastructure, helping organizations identify common security misconfigurations and vulnerabilities across their own public-facing websites.

Both services exist specifically within NCSC’s broader Active Cyber Defence programme, and both are genuinely free to eligible UK organizations, yet remain surprisingly underused given how directly they address exactly the categories of risk this guide has developed throughout, misconfiguration, exposed vulnerabilities, weak email authentication that phishing attacks exploit. A business that has never checked whether it qualifies for either service is leaving a genuinely free, government-backed assessment unused, precisely the kind of overlooked, low-cost win worth actively pursuing rather than assuming only paid, commercial tools can provide this specific kind of assessment.

NCSC Just Changed Its Password Guidance: Here’s What Changed and Why

Here is a genuinely major, very recent shift most current content has not caught up to yet. At CYBERUK 2026, NCSC’s own annual conference, the agency announced that passkeys should now be the default way of logging into online services wherever they are available, explicitly overturning decades of password-first advice. This marks the first time NCSC has told consumers to move away from passwords entirely, rather than simply advising how to create a stronger one.

NCSC’s own technical analysis concluded passkeys are at least as secure as, and generally more secure than, a password combined with two-step verification. The agency had actually considered this shift earlier but deliberately held off until specific implementation challenges, inconsistent passkey naming across different platforms, unreliable device support, limited credential manager compatibility, had genuinely narrowed enough across the industry to justify the change. NCSC specifically named platforms including Google, eBay and PayPal as having made passkey adoption meaningfully easier for users. For services that do not yet support passkeys, NCSC’s guidance still recommends a password manager paired with two-step verification, meaning the long-standing “three random words” approach to password creation remains genuinely relevant advice specifically for that fallback scenario, but it is no longer the primary, leading recommendation it once was. Any business still treating password creation guidance as NCSC’s central authentication advice, without acknowledging this shift toward passkeys as the new default, is working from outdated guidance on precisely the topic where NCSC’s own position has moved most significantly and most recently.

What Does an OWASP Top 10 Report Tell You, Versus a Full Penetration Test Report?

An OWASP Top 10-based assessment checks a web application against the ten specific risk categories this guide has developed throughout, providing a structured, standardized view of whether an application shows signs of these particular, well-documented vulnerability classes. This is genuinely valuable as a baseline, but it represents a defined, bounded scope, not an exhaustive assessment of every possible way an application could be compromised.

A full penetration test goes considerably further, actively attempting to exploit vulnerabilities a skilled tester identifies, including business-logic-specific flaws no generic checklist could anticipate, chained exploits combining multiple smaller issues into a serious compromise, and vulnerabilities genuinely unique to your specific application’s own particular design and functionality. The practical distinction worth understanding directly: an OWASP-based report tells you whether your application shows signs of known, well-documented risk categories. A penetration test tells you whether a skilled, motivated attacker could genuinely break into your specific application, using whatever combination of techniques actually works against your particular setup, a meaningfully deeper and more realistic test of your actual security posture. Cyber Security Solutions Ltd typically recommends OWASP-based scanning as an ongoing, regular baseline check, complemented by periodic full penetration testing specifically for applications handling genuinely sensitive data, since neither approach alone provides the complete picture the other is specifically designed to fill in.

Conclusion

Web security requires staying current with genuinely fast-moving guidance, and both the OWASP Top 10 and NCSC’s own password recommendations shifted significantly enough recently that content referencing older versions is now meaningfully out of date. Start by confirming whether your own team is still working from the 2021 OWASP rankings or outdated password guidance. To get a current web security assessment for your organization, visit cybersecuritysolutionsltd.com for expert support from Cyber Security Solutions Ltd.