BETA Shoulder is in beta — Findings may sometimes be wrong. Your feedback shapes what we fix next. Share feedback
#6 A06:2025

Insecure Design

Insecure design is a broad category representing different weaknesses, expressed as missing or ineffective control design. This is distinct from implementation flaws.

Overview

Slides from #4 to #6 in 2025. Introduced in 2021, there have been noticeable improvements in the industry related to threat modeling and greater emphasis on secure design. Focus on risks related to design and architectural flaws.

How Attackers Exploit This

Understanding attack patterns helps you build better defenses. These are the techniques security teams watch for.

Business logic bypass

Application flows can be circumvented because the design didn't account for all possible user paths or state transitions.

Detection signal: Users completing processes in unexpected order, missing validation at critical steps

Missing rate limiting

Sensitive operations like password reset or account creation lack rate limits, enabling automated attacks.

Detection signal: High volume of requests to sensitive endpoints from single sources

Insufficient anti-automation

Critical functions lack protections against automated abuse, such as CAPTCHA or proof-of-work.

Detection signal: Bot-like traffic patterns, automated form submissions

How to Prevent

  • Establish a secure development lifecycle with security professionals
  • Use threat modeling for critical authentication and access control
  • Integrate security language and controls into user stories
  • Write unit and integration tests to validate security controls
  • Segregate tier layers based on exposure and protection needs
  • Limit resource consumption by user or service

CWEs with Shoulder Detection (8)

These CWEs have Shoulder detection rules. Click to see specific vulnerabilities and fixes.

Other Mapped CWEs (32)

These CWEs are mapped to this category. Use MITRE references for guidance.