"Most Kenyan businesses discover a security problem the same way: a customer reports something strange, a payment fails oddly, or a partner's compliance team asks a question nobody can answer."
The OWASP Top 10 gets cited constantly and read rarely. This is a field-notes version, grounded in what actually shows up assessing web and API applications built and deployed for the Kenyan market — not a re-hash of the official list.
1. Severity Snapshot
Across authorized assessments of web and API applications serving the Kenyan market, six OWASP categories account for the overwhelming majority of exploitable findings.
2. Broken Access Control
The single most common finding: an authenticated user can act on another tenant's data by changing an ID in the URL or request body — Broken Object-Level Authorization (BOLA), the classic IDOR. Multi-tenant SaaS products built quickly under deadline pressure are especially exposed: authentication is implemented, but per-object authorization checks are not.
Security Principle
Being logged in is not the same as being authorized for this specific record.
3. Injection
SQL, NoSQL, and command injection remain common where raw user input reaches a query or shell call without parameterization — frequently in admin/internal tooling that was never expected to face untrusted input, then later exposed via an API gateway or a partner integration.
4. Security Misconfiguration
Verbose stack traces left on in production, default credentials left on a staging environment that's reachable from the public internet, and open admin paths (/admin, /.env) discoverable by any scanner. Cheap to find, cheap to fix, expensive to leave.
5. Authentication Failures
Weak password-reset flows — predictable tokens, no rate limiting on the reset endpoint — and session tokens that don't expire or rotate when a user's privilege level changes.
6. Logging & Monitoring Failures
The quiet one. Many organizations only discover they were compromised weeks later, via a third party, because no tamper-evident audit trail existed to answer "what happened, and when?"
7. What This Means Under KDPA
Several of these categories create direct statutory exposure under the Kenya Data Protection Act when personal data is involved — broken access control and injection both create a plausible path to a reportable data breach, not just a technical finding on a report nobody reads.
| OWASP Category | KDPA Relevance |
|---|---|
| Broken Access Control | Direct risk of unauthorized personal data access |
| Injection | Risk of bulk data exposure/exfiltration |
| Security Misconfiguration | Increases attack surface for the above |
| Auth Failures | Account takeover → unauthorized data access |
| Logging Failures | Breach cannot be scoped or reported accurately |
Guiding Principle
A scanner finds candidates. A human confirms whether each one is actually exploitable in your context, and what it costs you if it is.
Skills Demonstrated: Application Security · OWASP Top 10 · Broken Access Control · Injection · KDPA Compliance Mapping · Security Assessment
Related services: Web & API Security Assessment · Security Audits