A09: Security Logging and Alerting Failures

Security Logging and Alerting Failures occur when an application does not adequately record, analyze, or respond to security-relevant events, allowing attackers to operate undetected. Without proper logging and alerting, organizations may fail to detect breaches, track suspicious activity, or respond to incidents in a timely manner, leading to data theft, system compromise, or prolonged attacker persistence. The OWASP Top 10:2025 renamed this category from Security Logging and Monitoring Failures to emphasize the point that matters: a log nobody is alerted on does not shorten a breach.

Common Vulnerabilities:

• Lack of Logging for Critical Events (e.g., Logins, Failed Authentication Attempts, Privilege Escalations)
• Failure to Detect or Alert on Repeated Brute-Force or Unauthorized Access Attempts
• Logs That Lack Sufficient Detail (e.g., Missing Timestamps, User IDs, IP Addresses)
• Storing Logs in Insecure Locations, Allowing Attackers to Modify or Delete Evidence
• No Real-Time Monitoring or Automated Alerting on Security Events
• Alerts With No Defined Owner or Response Procedure
• Log Retention Too Short to Support Incident Investigation
• Overwhelming False Positives or Alert Fatigue, Causing Legitimate Threats to Be Ignored

To mitigate these risks, organizations should enable logging for authentication and critical system events, securely store and protect logs from tampering, implement real-time alerting with a defined response path for each alert, and regularly review logs to detect anomalies. Using Security Information and Event Management (SIEM) solutions and setting up proactive incident response workflows can significantly improve security visibility and threat detection.