Security Logging and Alerting Failures
2025 renames the 2021 monitoring category to stress alerting, not only log lines. Hard to prove from outside. Note where a sensitive action gives the defender no signal, and where user input is written into logs that another system renders.
OWASP rank: 9
Practical checks
- List sensitive actions (login failure, role change, export, admin impersonation) and whether the UI implies they are audited
- If a program invites log-injection notes, use a harmless marker and stop
- Do not claim 'no logging' unless you have evidence from the product or the program
- A missing alert is context for a real bug, rarely a standalone report
- Keep customer data out of any log sample you save