OWASP Launches Subtractive Security Top 10 to Eliminate Cyberattack Paths

The Open Worldwide Application Security Project (OWASP) has introduced the Subtractive Security Top 10, a new engineering-focused cybersecurity initiative designed to reduce attack surfaces by eliminating unnecessary attack paths rather than continually adding defensive controls.

Led by project founder Christopher Frenz, the framework challenges a long-standing security model in which organizations deploy additional monitoring tools, alerts, logging systems, and endpoint controls while many of the architectural conditions attackers exploit remain unchanged.

The core principle behind Subtractive Security is straightforward: attackers can only traverse paths that exist. By eliminating unnecessary privileges, legacy protocols, dormant identities, exposed services, trust relationships, and communication routes, organizations can remove opportunities for lateral movement, privilege escalation, persistence, and data theft.

OWASP Launches Subtractive Security

Instead of asking which additional security product should be deployed, the framework encourages engineering teams to determine which components or relationships can safely be removed from an environment.

OWASP’s model organizes defensive measures into a three-tier hierarchy: Architectural Deletion, Architectural Constraint, and Monitoring and Detection.

Architectural Deletion is positioned as the strongest and most durable approach because it completely eliminates an attack path.

Examples include disabling obsolete protocols, deleting dormant accounts, removing unnecessary administrative privileges, shutting down unused services, and eliminating unnecessary internet exposure. If a vulnerable capability no longer exists, attackers cannot exploit it.

When complete removal is operationally impractical, OWASP recommends Architectural Constraint. This includes network segmentation, private endpoints, conditional access policies, application controls, firewall restrictions, and permission boundaries that reduce an attacker’s ability to move between systems.

Traditional technologies such as SIEM, endpoint detection and response (EDR), intrusion detection systems, and intrusion prevention systems remain important, but the framework positions monitoring and detection as the final defensive layer for risks that cannot be structurally eliminated or constrained.

A major component of the initiative is the Path Erasure Rate (PER), a metric intended to quantify how effectively organizations eliminate identified attack paths.

OWASP defines the measurement as PER = |Perased| / |Peligible|, representing the proportion of eligible attack paths that have been structurally erased.

The concept provides security teams with an engineering cycle in which they identify attacker routes, measure exposure, eliminate or constrain unnecessary paths, calculate the resulting reduction, and continuously refine infrastructure architecture.

This approach could become increasingly relevant as artificial intelligence accelerates vulnerability discovery and exploit development.

Instead of relying exclusively on rapidly patching every newly disclosed CVE, organizations can implement architectural changes that neutralize entire classes of attacks.

For example, preventing browsers from launching unnecessary child processes or disabling legacy LLMNR broadcasts could eliminate exploitation opportunities across numerous endpoints simultaneously.

Beyond its platform-independent Universal Subtractive Security Laws Top 10, the project includes environment-specific guidance covering Windows, Linux, Active Directory, AWS, Microsoft 365, networking, IoT, and macOS.

Additional standards covering identity and access management, Azure, Google Cloud Platform, Kubernetes, CI/CD environments, and AI/LLM infrastructure are also planned.

The framework encourages organizations to implement these standards together because modern attack chains frequently cross identity, operating system, network, application, and cloud boundaries.

For enterprises combating ransomware and advanced intrusions, Subtractive Security translates into practical architectural changes.

Organizations can remove unused local administrator accounts, disable unnecessary remote-access protocols, restrict east-west network communication.

Eliminate public-facing services that do not require internet exposure, and reduce excessive cloud identity permissions. These actions can significantly limit what attackers are capable of doing even after obtaining initial access.

The project and its PER 1.0 specification are available under the Apache License 2.0 and are open to community contributions through GitHub.

By emphasizing measurable attack-path elimination, OWASP’s Subtractive Security initiative aims to transform attack-surface reduction from a general security recommendation into a repeatable engineering discipline.