Application Self Protection – A New Addition to the OWASP Top 10

The 2023 OWASP API Security Top 10 keeps BOLA and Broken Authentication on top while adding SSRF, unrestricted resource consumption, and unsafe API consumption; industry pros react.

API security remains underprioritized as usage surges; the 2023 OWASP API Security Top 10 still leads with BOLA and broken authentication, and manual testing is needed where scanners fall short.

OpenSAMM, OWASP's free maturity framework, splits app security into four business functions—Governance, Construction, Verification, Deployment—letting organizations score each app in under an hour.

We were asked by a customer about performing code review based on the PCI requirements.

SaaS providers face rising API and multi-tenant threats; regular pentesting aligned to OWASP and PTES across the SDLC reduces breach risk and supports SOC 2, ISO 27001, GDPR, and HIPAA.

APIs expose backend logic and sensitive data directly; targeted API security testing uncovers broken authentication, excessive data exposure, and access control flaws that traditional pentests miss.