Web security in 2026: OWASP Top 10, but practical, with what we actually see in incidents

invalid@example.com (Aior), Aior
Fri, 01 May 2026 07:49:04 +0000
Web Security

The threats that actually show up​
The OWASP Top 10 is the standard reference. It's also abstract enough that teams read it, nod, and don't translate it to their own code. Below is what those classes of attack actually look like in incidents we've responded to, and the controls that prevent them.

Broken access control​
Top of the list for a reason. The shape:

Endpoint that returns a user's data accepts a user_id parameter, doesn't verify the requesting user has rights to...