OWASP has launched the Subtractive Security Top 10 project, a security engineering initiative that shifts the focus from adding more detection controls to removing the architectural conditions that enable cyberattacks.
The project, led by Christopher Frenz, promotes a straightforward premise: attackers can only exploit attack paths that exist.
Instead of relying primarily on monitoring, alerting, endpoint detection, or SIEM tooling to identify malicious activity after it occurs, the framework encourages organizations to eliminate unnecessary exposure, privileges, trust relationships, services, and communication paths before they can be abused.
The initiative is available as an open-source project under the Apache License 2.0 and includes platform-specific hardening guidance for Windows, Linux, Active Directory, AWS, Microsoft 365, network infrastructure, IoT, and macOS environments.
OWASP Introduces Subtractive Security Top 10
Traditional security programs often focus on layering preventive and detective controls around systems that remain highly connected and overprivileged.
OWASP’s Subtractive Security approach argues that eliminating a vulnerable or unnecessary pathway is generally more effective than trying to observe or manage its use.
The project establishes a hierarchy of control effectiveness:
| Priority | Security Approach | Example Actions |
|---|---|---|
| 1 | Architectural deletion | Remove legacy protocols, dormant identities, public exposure, or unnecessary privileges |
| 2 | Architectural constraint | Apply segmentation, permission boundaries, conditional access, private endpoints, and privilege restrictions |
| 3 | Monitoring and detection | Use logging, alerting, SIEM, IDS/IPS, and endpoint detection for residual risks |
Under this model, monitoring remains important, but it is positioned as the final layer for attack paths that cannot be removed or sufficiently constrained.
The central question of the project is: what can be removed to make an attack materially more difficult or impossible? Examples include disabling unused remote access services, eliminating excessive cloud identity permissions, removing obsolete authentication protocols, and restricting unnecessary east-west network communication.
OWASP’s Subtractive Security Top 10 aligns with the Path Erasure Rate (PER) standard. PER quantifies how many identified, actionable attacker paths have been structurally eliminated from a given environment.
PER=∣Peligible​∣∣Perased​∣​In this formula, \( P_{\text{eligible}} \) represents valid attack paths within scope, while \( P_{\text{erased}} \) indicates paths where executable edges have been removed.
The metric is designed to give security teams a way to measure architectural risk reduction instead of relying solely on control coverage, alert volume, or compliance outcomes.
The framework outlines a repeatable process: identify attack paths, assess exposure, eliminate or constrain paths, measure the reduction, and continuously improve the architecture.
The initiative is designed for parallel adoption across technology layers since attack chains often cross boundaries between endpoints, identity systems, cloud environments, and networks.
For instance, an organization could apply AWS and Linux guidance simultaneously to reduce cloud control-plane access and operating-system privilege escalation opportunities.
Similarly, Active Directory and Windows guidance can be combined to address identity abuse and lateral movement from workstations to the domain.
OWASP describes this as defense in depth through “layered path erasure.” The goal is to create multiple non-conductive boundaries that prevent attackers from progressing, even if an initial compromise occurs.
Future project areas are expected to include identity and access management, Azure, Google Cloud Platform, Kubernetes, CI/CD pipelines, software supply chains, AI and LLM infrastructure, and medical devices.
The project invites security engineers, researchers, architects, and defenders to contribute their implementation experiences and evidence-based techniques for reducing attack paths.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
