The OWASP has unveiled the Subtractive Security Top 10, an innovative engineering initiative that pivots cybersecurity strategy from detection to outright attack path elimination, diverging from traditional "add more controls" approaches.
Subtractive Security Core Principles Principle Description Priority Level Architectural Deletion Remove attack paths entirely (legacy protocols, unnecessary privileges, public exposure, dormant identities, unneeded trust relationships) Highest preferred whenever feasible Architectural Constraint Limit attack paths that cannot be fully removed (segmentation, permission boundaries, conditional access, private endpoints, privilege restrictions) Second used when deletion isn’t possible Monitoring & Detection Observe residual risk that can’t be deleted or constrained (logging, alerting, SIEM, IDS/IPS, EDR) Lowest last line of defense only Guiding Axiom "Attackers can only traverse paths that exist" eliminate paths until adversary activity can’t compose into material business impact Foundational belief driving the framework Reduce Reachability Shrink the set of systems/services an adversary can reach from any given point Universal architectural law Reduce Trust Relationships Eliminate unnecessary implicit trust between systems, identities, and domains Universal architectural law Reduce Credential Exposure Minimize where and how long credentials are accessible or reusable Universal architectural law Reduce Privilege Propagation Prevent privileges from cascading across systems or sessions Universal architectural law Reduce Executable Attack Paths Remove code-execution routes attackers could exploit to advance Universal architectural law Enforce Deterministic Communications Restrict network/system communication to only explicitly defined, expected paths Universal architectural law Measure via PER Quantify structural improvement using Path Erasure Rate (erased paths ÷ eligible paths) Validation mechanism for all above Rather than racing to patch each newly disclosed CVE, a reactive cycle increasingly outpaced by AI-accelerated exploit development, Subtractive Security’s PER pushes teams to calculate the net "path-reduction delta".
