Listen to this Post
Introduction: A New Security Philosophy Built Around Elimination
For decades, cybersecurity teams have followed a familiar pattern: when attackers discover new techniques, organizations respond by adding more defenses. More firewalls, more detection tools, more alerts, more monitoring platforms, and more security products have become the standard approach. However, this defensive model has created a complicated security ecosystem where companies continuously fight symptoms while the original weaknesses remain.
The newly introduced OWASP Subtractive Security Top 10 challenges this traditional mindset by asking a much simpler but more powerful question: What if organizations stopped giving attackers so many paths to begin with?
Instead of focusing primarily on discovering malicious activity after an attacker enters an environment, the initiative promotes a security engineering approach based on removing unnecessary pathways that attackers depend on. The philosophy is straightforward: attackers cannot exploit routes that no longer exist.
Led by cybersecurity expert Christopher Frenz, the project introduces a new framework that prioritizes architectural improvements over endless layers of defensive tools. It encourages organizations to reduce unnecessary privileges, eliminate outdated protocols, remove excessive trust relationships, and simplify complex environments that often create hidden security weaknesses.
The Traditional Security Problem: Too Many Tools, Too Many Attack Paths
Cybersecurity Has Become a Reactive Industry
Modern enterprises operate thousands of systems, identities, applications, cloud services, and network connections. Every additional component introduces possible weaknesses. Over time, organizations have responded by adding more security controls.
A typical enterprise environment may include:
Endpoint Detection and Response (EDR)
Security Information and Event Management (SIEM)
Identity monitoring platforms
Intrusion Prevention Systems (IPS)
Cloud security tools
Vulnerability scanners
Threat intelligence platforms
These technologies are valuable, but they often operate after an attack path already exists.
An attacker does not need to defeat every security solution. They only need one forgotten account, one exposed service, one weak permission, or one unnecessary trust relationship.
The OWASP Subtractive Security Top 10 argues that organizations should stop asking:
How can we detect attackers faster?
and start asking:
“Why does this attack path exist at all?”
OWASP Subtractive Security Top 10: Security Through Removal
Eliminating the Terrain Attackers Need
The foundation of the Subtractive Security model is based on a simple principle:
Attackers can only move through paths that exist.
Every cyberattack requires a chain of opportunities:
Initial access
Credential discovery
Privilege escalation
Lateral movement
Persistence
Data access
Data theft or destruction
If organizations remove enough links in this chain, attackers lose the ability to transform a small compromise into a major incident.
The framework focuses on reducing:
Reachable systems
Excessive privileges
Credential exposure
Trust relationships
Communication paths
Execution opportunities
Instead of continuously adding new defensive layers, security teams redesign environments so attackers have fewer options.
Three Levels of Subtractive Security Controls
1. Architectural Deletion: The Strongest Security Improvement
The highest priority in the framework is removing unnecessary attack paths completely.
Examples include:
Removing inactive user accounts
Eliminating outdated authentication protocols
Deleting unnecessary administrator privileges
Removing publicly exposed services
Removing unused software components
Eliminating unnecessary network connections
Deletion creates the most permanent security improvement because the attacker’s option disappears completely.
For example, disabling an unused remote access protocol does not simply create an alert when abused. It removes the possibility of abuse.
2. Architectural Constraint: Limiting Remaining Risk
Not every system or connection can be removed. Large organizations must maintain complex environments for business operations.
When deletion is impossible, OWASP recommends restricting access through architectural constraints.
Examples include:
Network segmentation
Private endpoints
Conditional access policies
Permission boundaries
Zero Trust controls
Least privilege enforcement
The objective is to make attacker movement difficult and expensive.
A compromised workstation should not automatically provide access to critical databases, cloud environments, or administrative systems.
- Monitoring and Detection: The Final Defense Layer
Detection remains important, but OWASP places it as the final stage rather than the primary strategy.
Security monitoring tools such as:
SIEM platforms
EDR solutions
IDS/IPS systems
Threat hunting platforms
should focus on identifying attacks that remain possible after architectural improvements.
The framework argues that detection should support prevention, not replace it.
Path Erasure Rate (PER): Measuring Security Improvement
A New Metric for Cybersecurity Engineering
One of the most important concepts introduced by OWASP is the Path Erasure Rate (PER).
Traditional security measurements often focus on:
Number of alerts detected
Number of vulnerabilities patched
Number of incidents prevented
PER introduces a different measurement:
How many possible attack paths have been permanently removed?
The formula is:
PER = |Perased| / |Peligible|
Where:
Perased = attacker paths that have been eliminated
Peligible = attacker paths that could realistically be removed
This creates a measurable security improvement cycle:
Identify possible attack routes.
Calculate which routes can be eliminated.
Remove unnecessary paths.
Measure the reduction.
Continue improving architecture.
Instead of asking whether a company has enough security tools, teams can measure whether attackers have fewer available options.
Subtractive Security Principles Explained
Reduce Reachability
Attackers succeed because systems are connected.
Reducing unnecessary access between:
Users
Applications
Servers
Cloud environments
Databases
limits the damage caused by compromised accounts or devices.
Reduce Trust Relationships
Implicit trust is one of the biggest security weaknesses.
Examples:
Excessive Active Directory trust
Shared cloud permissions
Overly broad API access
Cross-environment authentication
Removing unnecessary trust relationships prevents attackers from expanding their control.
Reduce Credential Exposure
Credentials remain one of the most valuable targets for attackers.
Security teams should reduce:
Credential storage locations
Credential lifetime
Password reuse
Administrative access exposure
The fewer places credentials exist, the fewer opportunities attackers have.
Reduce Privilege Propagation
A compromised user should not become a pathway to complete organizational control.
Privilege boundaries should prevent:
User-to-admin escalation
Workstation-to-domain compromise
Cloud-user-to-cloud-admin takeover
Enforce Deterministic Communication
Modern environments often allow systems to communicate too freely.
A safer architecture defines:
Which systems can communicate
Which users can access resources
Which applications can execute actions
Everything else should be blocked by default.
Deep Analysis: How Subtractive Security Changes Modern Cyber Defense
Security Evolution From Detection to Prevention
For years, cybersecurity maturity was measured by how quickly organizations detected and responded to attacks.
However, AI-powered cybercrime is changing the equation.
Attackers now use automation to:
Discover exposed systems
Generate malware variants
Identify vulnerable services
Analyze stolen credentials
Automate exploitation
The traditional security model is struggling because humans cannot manually investigate an unlimited number of alerts.
Subtractive Security addresses this problem by reducing the number of possible attack scenarios.
Example: Removing Legacy Protocols
Many organizations still maintain outdated protocols for compatibility reasons.
Examples:
LLMNR
NTLM authentication
Older SMB configurations
Attackers frequently abuse these technologies for credential theft and lateral movement.
A subtractive approach would remove them entirely:
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
or disable unnecessary services:
Stop-Service -Name "ServiceName" Set-Service -Name "ServiceName" -StartupType Disabled
The goal is not to detect abuse.
The goal is to make abuse impossible.
Example: Reducing Linux Attack Surface
Linux servers often contain unnecessary packages, services, and permissions.
Security teams can identify running services:
systemctl list-units --type=service
Remove unnecessary packages:
sudo apt remove package-name
Review listening ports:
sudo ss -tulpn
Every removed service represents one fewer possible entry point.
Example: Cloud Identity Reduction
Cloud environments frequently suffer from excessive permissions.
A subtractive security approach focuses on:
Removing unused IAM roles
Reducing administrator accounts
Limiting API permissions
Eliminating unnecessary service connections
Example AWS review:
aws iam list-users aws iam list-roles
Unused permissions are not harmless. They are potential attacker opportunities.
Enterprise Impact: Fighting Ransomware Through Attack Path Reduction
Making Initial Compromise Less Valuable
Modern ransomware groups rarely rely on a single vulnerability.
They build attack chains:
Phishing email
Credential theft
Privilege escalation
Domain compromise
Data encryption
Extortion
Subtractive Security attacks this chain directly.
Organizations can reduce ransomware risk by:
Removing local administrator accounts
Restricting remote access
Segmenting networks
Reducing cloud permissions
Eliminating unnecessary services
Even if attackers gain initial access, their ability to continue the attack becomes limited.
OWASP Expands the Framework Across Multiple Environments
Security Standards Designed for Real Enterprise Complexity
The Subtractive Security Top 10 is not limited to one platform.
OWASP has created environment-specific implementations covering:
Windows
Linux
Active Directory
AWS
Microsoft 365
Networking
IoT
macOS
Future standards are planned for:
IAM
Azure
Google Cloud Platform
Kubernetes
CI/CD environments
AI and LLM infrastructure
This reflects modern reality: attackers rarely stay inside one layer.
A compromised cloud workload can lead to operating system exploitation. A stolen identity can become access to cloud administration. A vulnerable application can become a gateway into the entire enterprise.
What Undercode Say:
Cybersecurity has spent years building taller walls while leaving thousands of unlocked doors behind.
The OWASP Subtractive Security Top 10 represents a major philosophical shift.
The biggest security improvements often come from removing complexity, not adding more technology.
Every unused account is a possible attacker identity.
Every unnecessary permission is a possible escalation path.
Every exposed service is a possible entry point.
Every outdated protocol is a possible weakness.
Modern enterprises have become extremely complex environments, and complexity itself has become a security risk.
Attackers do not need perfect access.
They only need one forgotten pathway.
The future of cybersecurity will likely depend less on collecting more alerts and more on engineering cleaner environments.
AI-powered attackers will increase attack speed dramatically.
Security teams cannot manually respond to unlimited automated threats.
Reducing the available attack surface becomes a necessary strategy.
The Path Erasure Rate concept is interesting because it transforms security improvement into something measurable.
Companies can finally evaluate whether their architecture is becoming harder to attack.
Traditional cybersecurity asks:
Did we detect the attacker?
Subtractive Security asks:
Why did the attacker have a path?
That question changes everything.
Zero Trust principles already moved security away from automatic trust.
Subtractive Security pushes the idea further by removing unnecessary trust completely.
The strongest defense is not always a better alarm system.
Sometimes it is removing the door.
Organizations adopting this model may discover that fewer systems, fewer privileges, and fewer connections create stronger security outcomes.
The challenge will be cultural.
Many companies hesitate to remove access because they fear operational disruption.
However, maintaining unnecessary exposure creates long-term security debt.
The future security leader may not be the company with the most security products.
It may be the company with the smallest attack surface.
✅ OWASP Subtractive Security Top 10 Is a Real Security Initiative
The initiative introduces a framework focused on reducing attack paths instead of only detecting threats.
The project is associated with OWASP and promotes engineering-based security improvements.
The concepts of architectural deletion, constraints, and attack-path reduction align with modern Zero Trust strategies.
✅ Path Erasure Rate (PER) Is a Core Concept of the Framework
PER is presented as a measurement method for tracking eliminated attack paths.
It provides organizations with a way to quantify architectural security improvements.
The metric supports continuous security optimization rather than one-time compliance activities.
✅ The Framework Addresses Modern Enterprise Security Challenges
The approach targets common enterprise weaknesses including excessive permissions, legacy systems, and unnecessary trust relationships.
These issues are frequently involved in ransomware campaigns and identity-based attacks.
Reducing attack surface is widely recognized as an important cybersecurity principle.
Prediction
(+1) Subtractive Security Will Become a Major Enterprise Security Practice
As AI-driven attacks increase, organizations will struggle to investigate every possible threat.
Security teams will increasingly prioritize reducing attack opportunities before incidents occur.
Frameworks similar to OWASP Subtractive Security may become integrated into security architecture reviews, cloud governance, and compliance programs.
Companies that successfully remove unnecessary complexity will likely experience fewer successful breaches and faster incident recovery.
Conclusion: The Future of Cybersecurity May Be About Removing, Not Adding
The OWASP Subtractive Security Top 10 introduces a powerful idea: cybersecurity should not only be about detecting attackers after they enter.
The strongest security architecture prevents attackers from having meaningful paths in the first place.
As cyber threats become faster, smarter, and increasingly automated, organizations may no longer be able to win through endless layers of defensive technology.
The next generation of cybersecurity may depend on simplicity.
Less exposure.
Less privilege.
Less unnecessary access.
Fewer attack paths.
Because the safest system is often the one where attackers have nowhere left to go.
▶️ Related Video (80% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.reddit.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
