# A06:2025 - Insecure Design

> Security flaws rooted in architecture and planning rather than implementation.

- **Category**: Owasp Security
- **Subcategory**: top10_2025
- **Canonical URL**: https://designpattern.fyi/owasp_security/a06_insecure_design/

---

## Description
'**Intent**: Build security into the design phase rather than bolting it on afterwards.

**Context**: Insecure design represents flaws that cannot be fixed by perfect implementation alone. They stem from missing or ineffective security controls during the architecture and design phases.

**Solution**: Use threat modeling. Integrate security requirements early. Apply secure design patterns. Write unit and integration tests for critical flows. Implement defense in depth at the architecture level.'



## Use Cases
Use during system architecture and design phases to prevent fundamental security weaknesses.





## Trade-offs


### Advantages

- Prevents entire classes of vulnerabilities

- Reduces cost of security fixes

- Enables proactive security posture

- Aligns with secure SDLC practices




### Considerations & Drawbacks

- Requires security expertise during design

- May slow initial development

- Difficult to retrofit into existing systems







---
**Reference**: [Original Source](https://owasp.org/Top10/2025)