TL;DR: Use OWASP Top 10:2025 as the current risk taxonomy. Platform work shapes several categories: TLS posture, security headers, dependency currency, SSRF limits on cloud credentials, rate limiting, and the logging that detects exploitation. Knowing which risks live in the platform versus application code is the actual interview skill.
How to approach it
Say what the document is in one sentence, then refuse to recite it. Map categories to owners: what you fix in the platform, what you gate in the pipeline, what belongs to application teams. The mapping is the demonstration; the list is just vocabulary.
A strong answer
As of September 2026, the current released web-application list is OWASP Top 10:2025. Its categories cover broken access control, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, software or data integrity failures, security logging and alerting failures, and mishandling of exceptional conditions. SSRF remains relevant but is now included under broken access control.
Security misconfiguration spans platform and application ownership. The platform can standardize TLS, remove exposed admin defaults and supply safe proxy settings. Applications must avoid verbose errors and insecure feature configuration. CSP needs coordination with the application’s scripts, nonces and rendering; applying a generic header at the proxy is not sufficient.
Software supply chain failures include dependency and build-system risks. Maintain component inventory, protect build identities and verify provenance as well as scanning dependencies. Application teams remediate their code; platform teams maintain shared images and pipeline controls. For security logging and alerting, applications must emit useful authentication and authorization events. The platform transports and retains them, and detection owners test that alerts fire. OWASP’s logging guidance explains why infrastructure logs alone lack application context.
Cloud-flavoured and worth raising unprompted: SSRF. When an application can be tricked into fetching attacker-chosen URLs, the interesting target in cloud is the metadata endpoint handing out instance credentials. Require IMDSv2 on EC2 and restrict unnecessary metadata access, but also validate the application’s fetch destinations and redirects. A vulnerable fetcher can target internal services beyond metadata. Apply egress controls and prevent DNS-rebinding bypasses; OWASP’s SSRF prevention guidance covers the application and network layers.
The 2025 exceptional-conditions category is especially relevant to operations: if an authorization dependency times out, the service must not grant access by default. Exercise failure behavior, bounded retries and rollback of partial operations. OWASP A10:2025 includes failures to handle such conditions securely.
Application-owned but supported by you: broken access control, insecure design, injection. You cannot fix logic bugs in the platform, yet you supply the WAF, bot management, rate limiting, and the test harnesses in CI that catch these earlier.
What interviewers probe next
"Which category is hardest to address outside the app team?" Broken access control and insecure design: the logic lives in code, so the platform contributes guardrails, fuzzing and review tooling rather than fixes. Claiming otherwise signals you have never sat with an application team through remediation.
"HSTS versus CSP?" HSTS tells supporting browsers to use HTTPS after learning the policy, or through a preload entry. CSP restricts resource loading and script execution according to its directives. It reduces XSS risk but does not repair unsafe rendering. Coordinate deployment with application changes; see the CSP cheat sheet.
"How do you stay current on this?" Name a concrete habit: tracking OWASP project releases and scanner feeds, and converting findings into sprint work with tickets rather than hallway warnings.
Common mistakes
Reciting all ten categories verbatim with no ownership mapping, answering a memory question nobody asked.
Overclaiming the WAF: it blunts common payloads and buys patching time, it does not repair broken access control.
Conflating the Top 10 with CVE feeds or CWE enumerations: the Top 10 prioritizes risk categories, CVE identifies disclosed vulnerabilities, and CWE describes weakness types.