Security work is moving closer to testing. Breaches are costly, attackers often get in through known weaknesses, and US employers keep hiring in the field. Here are three public sources (Verizon, IBM and the US Bureau of Labor Statistics), plus the OWASP Top 10, and what a tester can take from them.
One rule before anything else: security testing is done only on systems you are authorised to test, with the owner's written permission. Everything below rests on that rule.
TL;DR
- Verizon DBIR 2026: vulnerability exploitation started 31% of breaches, the most common way in.
- IBM 2026: a breach costs $11.5 million on average in the United States ($4.99 million worldwide).
- BLS: information security analyst jobs are projected to grow 21% from 2025 to 2035.
- OWASP: the current Top 10 is the 2025 edition.
How attackers get in: Verizon's 2026 report
The Verizon Data Breach Investigations Report 2026 covers incidents from 1 November 2024 to 31 October 2025. Its headline: exploiting a software vulnerability is now the leading way into a network, at 31% of breaches, ahead of stolen credentials. Help Net Security reports that this is the first time in the report's 19 years that credential theft has lost the top spot, and that only 26% of the vulnerabilities on CISA's "known exploited" list had been fully fixed across the 13,000 organisations polled, down from 38% the year before.
For a tester, the message is simple: a good share of breaches start with a flaw that someone could have found earlier. Finding it earlier is the job.
What a breach costs: IBM's 2026 report
IBM's Cost of a Data Breach Report 2026 puts the worldwide average at $4.99 million, up 12% and a record. According to a summary by the law firm Baker Donelson (report published 30 July 2026), the US average is $11.5 million per incident, up 11%, more than double the global figure. Treat averages with care: a small company is unlikely to see a bill that size, and the mix of cases changes from year to year.
The job market: what the BLS shows
The BLS tracks information security analysts. Its page, last modified on 27 August 2026, shows about 192,900 jobs in 2025, a median pay of $129,180 per year (May 2025), and projected growth of 21% from 2025 to 2035.
A caution: "information security analyst" is not the same job as "security tester", and these figures say nothing about what a graduate of any course would earn or whether they would be hired. They show where demand for security skills is heading, no more.
The OWASP Top 10: the 2025 edition
OWASP maintains the standard list of web application risks. The current version is the 2025 edition:
- A01 Broken Access Control
- A02 Security Misconfiguration
- A03 Software Supply Chain Failures
- A04 Cryptographic Failures
- A05 Injection
- A06 Insecure Design
- A07 Authentication Failures
- A08 Software or Data Integrity Failures
- A09 Security Logging and Alerting Failures
- A10 Mishandling of Exceptional Conditions
Software supply chain failures and the mishandling of exceptional conditions are the new ideas compared with the previous edition. OWASP notes that "Injection" runs from cross-site scripting (frequent, usually lower impact) to SQL injection (rarer, high impact).
Reading the list as a tester
The list is not a checklist to tick off once. It tells you where to look first. OWASP says that on average 3.73% of the applications tested had at least one of the 40 weaknesses grouped under Broken Access Control, which stays at number one. Security Misconfiguration moved up from fifth place in 2021 to second, because more of an application's behaviour now lives in configuration. Software Supply Chain Failures has the fewest occurrences in OWASP's data, but the highest average exploit and impact scores from known vulnerabilities, and OWASP believes testing has not yet caught up in this area.
For a QA team this has a practical meaning. Access control and configuration are checked with ordinary test techniques: roles, permissions, environments, default settings. You do not need to be an attacker to start. You need a method, a clear scope and the habit of asking "what if this user should not see this?"
What a security tester actually does
A security tester asks, on an authorised environment, the questions an attacker would ask. Can one user open another user's data by changing an ID in the URL? Does a form field accept code? Does an error message say too much? Are sessions and passwords well protected?
- Turn a risk list into test cases, starting from the OWASP Top 10.
- Test inputs: SQL injection, XSS, CSRF.
- Write a clear finding: what was tested, what was found, how to reproduce it, what the risk is.
- Stay in scope: defined perimeter, written authorisation, a test environment.
The method (preparing, executing, reporting) is the same as in any testing job. A course is not enough to make a specialist: hands-on experience matters just as much.
Where to start on an API
Broken access control is often easiest to see at the API level, where you can change an identifier or a role in a request and check what comes back. If you want that kind of check automated in a pipeline, ADC's API testing services cover functional, contract, negative, auth and performance tests, run remotely in English or French with the code in your repository.
The Sec Test specialisation
For testers who want a structured path, the Sec Test (Security Tester) page lists: OWASP Top 10, SQL injection, XSS and CSRF; 399 hours over 3 months; 100% online with mentoring included; 6-month platform access and 24-month replays; next session in December, with the exact date confirmed with an advisor.
Courses are taught in French, so check that this fits you before you enrol. Certifications for the specialisations are still to be confirmed with ADC, so none is promised for this track. Launch price: €1,500 for individuals (1 to 4 interest-free instalments), €7,500 for companies. ADC is not yet eligible for French public training funding (CPF, France Travail).
Over to you
Which OWASP Top 10:2025 category do you test for in your current project, and which one do you suspect nobody on your team has ever checked? If your team added "Software Supply Chain Failures" to its test plan, what did the first check look like?
Sources: Verizon: 2026 Data Breach Investigations Report · Help Net Security: Verizon DBIR 2026 findings (20 May 2026) · IBM: Cost of a Data Breach Report 2026 · Baker Donelson: Ten takeaways from IBM's 2026 report · US Bureau of Labor Statistics: Information Security Analysts (modified 27 August 2026) · OWASP: Top 10:2025
Originally published on AutomationDataCamp. Written with AI assistance. Every figure comes from the sources listed above, as cited in the original article (checked on 19 October 2026). This is general information, not legal or career advice.
AutomationDataCamp is an online software testing academy (Playwright, API testing, CI, AI-assisted testing, ISTQB prep). More on our site.
Top comments (0)