What are the OWASP Top 10 web application risks and how do you defend against them?

The OWASP Top 10 is the standard reference for web application risk. The current categories, with the defence for each:

• Broken Access Control — the top risk. Users reaching data or functions they should not. Defence: enforce authorisation server-side on every request, deny by default, and check object-level ownership — not just that the user has a role.
• Cryptographic Failures — data exposed through weak or absent encryption. Defence: TLS everywhere, strong algorithms, proper key management, and not storing what you do not need.
• Injection — SQL, command, and LDAP injection, plus cross-site scripting. Defence: parameterised queries, and context-appropriate output encoding.
• Insecure Design — flaws in the design itself, which no amount of secure coding fixes. Defence: threat modelling early.
• Security Misconfiguration — defaults left in place, verbose errors, unnecessary features enabled. Defence: hardened baselines and automated configuration checks.
• Vulnerable and Outdated Components — Defence: dependency scanning in CI and a patching process.
• Identification and Authentication Failures — Defence: MFA, breach-list password checks, rate limiting, secure session management.
• Software and Data Integrity Failures — unverified updates and insecure deserialisation. Defence: signed artefacts and verified pipelines.
• Security Logging and Monitoring Failures — Defence: log authentication and access-control events centrally, and alert on them.
• Server-Side Request Forgery (SSRF) — Defence: allowlist outbound destinations rather than blocklisting.