{
  "node_id": "owasp-top-10-2025-a02-security-misconfiguration",
  "title": "A02:2025 Security Misconfiguration",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-07-17",
  "bluf": "OWASP Top 10:2025 A02:2025 Security Misconfiguration. Security misconfiguration is when a system, application, or cloud service is set up incorrectly from a security perspective, creating vulnerabilities. This category sits within the OWASP Top 10:2025 (the 2025 edition, finalized January 2026), the canonical industry list of the ten most critical web application security risks. Organizations building web applications should treat each of the ten categories as both a design constraint and a continuous-monitoring obligation, with policies, automated testing, and incident response procedures defined per category. Mapped weaknesses: CWE-5, CWE-11, CWE-13, CWE-15, CWE-16, CWE-260, CWE-315, CWE-489, CWE-526, CWE-547, CWE-611, CWE-614, and others.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "ai_overlay_2026"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "owasp-asvs-l1",
    "owasp-asvs-l2",
    "nist-sp-800-53-r5",
    "iso-27001-2022"
  ],
  "primary_citations_count": 13
}