The OWASP Top 10:2025 places Broken Access Control first, followed by Security Misconfiguration and Software Supply Chain Failures. The order is useful, but the larger message is that application security is a system of design, dependencies, configuration and operations—not a single scanning stage.

Start with three engineering questions

  1. Can every sensitive action prove who is allowed to perform it?
  2. Can we reproduce and review the configuration that reaches production?
  3. Can we identify, verify and update every dependency and build input?

Access control: test the object, not just the page

Automated tests should exercise horizontal and vertical authorisation. Change resource identifiers, roles, tenant context and workflow order. Server-side checks must decide access on every request; hidden buttons and client routing are not controls.

Misconfiguration: make the secure path repeatable

Record secure defaults as code, remove sample features, separate secrets from configuration and compare deployed settings against a known baseline. Pay particular attention to debug modes, verbose errors, open cloud storage, permissive cross-origin rules and administrative endpoints.

Supply chain: know what built the release

Maintain dependency visibility, protect build identities, pin or verify critical inputs and define an update path. A software bill of materials can support this work, but it does not replace provenance, review or patch ownership.

A useful backlog formatWrite each security item as an observable failure, affected asset, owner, test and acceptance condition. “Improve authentication” is vague; “block cross-tenant invoice access and add an automated negative test” can be completed.

Measure evidence, not activity

Counts of scans and training sessions are easy to report. Better measures include time to close exploitable findings, percentage of sensitive routes with negative authorisation tests, dependency update age and production configuration drift.