OWASP Subtractive Security Top 10 Project Released to Identify and Reduce Cyber Risks

The Open Worldwide Application Security Project, or OWASP, has introduced the Subtractive Security Top 10 Project, a security engineering initiative focused on eliminating attack paths rather than merely detecting or monitoring them.

Traditional cyber defense often relies on adding security products, alerts, logging, endpoint tools, and access controls. The new OWASP project takes a different approach. It asks security teams a practical question: what can be removed to make an attack harder or impossible?

The project is built on a simple principle: attackers can only use existing paths. If an organization removes unnecessary access, services, trust relationships, privileges, protocols, and network exposure, attackers have fewer options for gaining access, moving laterally, escalating privileges, or maintaining persistence.

OWASP Subtractive Security Top 10

On GitHub, OWASP describes this approach as subtractive security, prioritizing structural changes that eliminate attacker paths. The project ranks security controls by their effectiveness in reducing the enterprise attack surface.

First is architectural deletion, where an attack path is completely removed. This can include removing legacy protocols, turning off unused services, deleting dormant accounts, eliminating public-facing exposure, and revoking unnecessary administrative privileges.

Second is architectural constraint. This applies when a path cannot be removed because of business or operational needs. Organizations can limit exposure using network segmentation, private endpoints, conditional access policies, permission boundaries, and privilege restrictions.

Monitoring and detection are placed third in the hierarchy. Logging, SIEM platforms, endpoint detection and response tools, intrusion detection systems, and alerts remain important. However, OWASP argues that detection alone does not remove the underlying route an attacker may use.

            
  Eliminate Attack Surface
[ Architectural Deletion ]
           │
           ▼
    Minimize Exposure
[ Architectural Constraint ]
           │
           ▼
 Detect Residual Threats
[ Monitoring & Detection ]

Core principle: Delete > Constrain > Monitor. Removing attack paths is the most effective defense, while monitoring is the last line of defense for residual risk.

Architectural Principles

No.	Subtractive Security Principle	Objective
1	Reduce unnecessary reachability	Remove network exposure and access routes that are not required for business operations
2	Reduce unnecessary trust relationships	Eliminate excessive cross-system, identity, and service trust dependencies
3	Reduce credential exposure	Limit credential availability, reuse, storage, and transmission paths
4	Reduce privilege propagation	Prevent administrative rights and permissions from spreading across systems and identities
5	Reduce executable attack paths	Remove services, protocols, applications, and configurations that attackers could exploit
6	Reduce control-plane exposure	Restrict access to cloud, identity, infrastructure, and management interfaces
7	Reduce attack-surface area	Decommission unused software, ports, accounts, APIs, and legacy components
8	Enforce deterministic communications	Allow only explicitly required inbound, outbound, and east-west traffic flows
9	Constrain residual attack paths	Apply segmentation, private endpoints, conditional access, and permission boundaries where removal is not feasible
10	Measure structural improvement through PER	Use the Path Erasure Rate (PER) to quantify eligible attack paths that have been structurally removed

The project introduces the Path Erasure Rate (PER) as a metric for measuring security improvements. PER calculates the proportion of eligible attack paths that have been structurally removed. In simple terms, it measures how many identified attacker routes no longer work after a security change.

The formula is expressed as PER=∣Perased∣/∣Peligible∣, where P _ {eligible}​ represents actionable attack paths within the defined scope and P_{erased} represents the paths that have been eliminated.

OWASP said the framework supports a repeatable process: identify attack paths, measure exposure, remove or constrain paths, measure the resulting risk reduction, and continuously improve the architecture.

The Subtractive Security Top 10 includes a universal set of security laws that can apply across technologies. It also provides platform-specific guidance for Windows, Linux, Active Directory, AWS, Microsoft 365, networks, Internet of Things devices, macOS, applications, data stores, high-performance computing environments, CI/CD pipelines, and artificial intelligence infrastructure.

For example, an organization could reduce ransomware exposure by removing unused local administrator accounts, disabling legacy remote access protocols, restricting east-west network communication, and removing unnecessary cloud identity permissions. These changes reduce the number of routes available to an attacker, even if one endpoint is compromised.

The project also promotes parallel implementation across technology layers. A cloud environment, for instance, should apply relevant AWS, Linux, identity, network, and CI/CD controls simultaneously. Attackers frequently cross these boundaries after an initial compromise.

The OWASP Subtractive Security Top 10 Project is available under the Apache License 2.0. Security researchers, architects, cloud engineers, and defenders can review, use, modify, and contribute to the guidance through its public GitHub repository.

Free Webinar: Beyond the Endpoint, The Next Evolution of Privileged Access -> Register Here