{
  "node_id": "owasp-top-10-2025-a08-software-or-data-integrity-failures",
  "title": "A08:2025 Software or Data Integrity Failures",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-07-17",
  "bluf": "OWASP Top 10:2025 A08:2025 Software or Data Integrity Failures. Software and data integrity failures involve code and infrastructure failing to protect against untrusted code or data being treated as valid. Examples include relying on plugins from untrusted sources, insecure CI/CD pipelines lacking integrity verification, auto-updates without proper checks, and insecure deserialization of attacker-modified data. This category sits within the OWASP Top 10:2025 (the 2025 edition, finalized January 2026), the canonical industry list of the ten most critical web application security risks. Organizations building web applications should treat each of the ten categories as both a design constraint and a continuous-monitoring obligation, with policies, automated testing, and incident response procedures defined per category. Mapped weaknesses: CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-565, CWE-829, CWE-830.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "ai_overlay_2026"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "owasp-asvs-l1",
    "owasp-asvs-l2",
    "nist-sp-800-53-r5",
    "iso-27001-2022"
  ],
  "primary_citations_count": 13
}