owasp/owasp-subtractive-hardening-top-10The OWASP Subtractive Security Top 10 Project is an initiative to identify, document, and promote the highest-impact opportunities for reducing cyber risk through the elimination of attack paths.
The OWASP Subtractive Security Top 10 Project is an initiative to identify, document, and promote the highest-impact opportunities for reducing cyber risk through the elimination of attack paths.
Unlike traditional security guidance that focuses primarily on adding controls, the Subtractive Security Top 10 emphasizes the removal of unnecessary attack surface, trust relationships, protocols, privileges, services, and communication paths that enable adversary progression.
The project is founded on the principle that the most effective security control is often the complete removal of an attack path rather than attempting to monitor or manage it.
The long-term vision of the project is to establish attack-path elimination as a foundational security engineering discipline supported by measurable outcomes through the Path Erasure Rate (PER) standard.
Attackers can only traverse paths that exist.
The objective of Subtractive Security is to systematically eliminate or constrain those paths until adversary activity can no longer compose into material business impact.
The purpose of this project is to provide practical, evidence-based guidance for identifying and eliminating common attacker paths across operating systems, cloud platforms, identity systems, and enterprise environments.
Each Top 10 focuses on attack paths whose removal produces disproportionate reductions in risk while minimizing operational impact.
The project seeks to answer a simple question:
What can be removed to make an attack materially more difficult or impossible?
The Subtractive Security Top 10 Project is aligned with the Path Erasure Rate (PER) Engineering Standard (https://github.com/cfrenz/Path-Erasure-Engine/blob/main/PER-1.0_Engineering_Specification.md) and the Path Erasure Precedence Standard (https://github.com/OWASP/OWASP-Subtractive-Hardening-Top-10/blob/main/PathErasurePrecedence.md)
PER provides a methodology for measuring the effectiveness of security improvements by quantifying the reduction of adversary-accessible attack paths.
$$\text{PER} = \frac{|P_{\text{erased}}|}{|P_{\text{eligible}}|}$$
Where $P_{\text{eligible}}$ represents valid, actionable attack paths identified within scope, and $P_{\text{erased}}$ represents the subset where executable edges have been structurally removed.
PER serves as the quantitative measurement framework for Subtractive Security.
The Subtractive Security Top 10 identifies high-value attack paths whose elimination is expected to produce meaningful reductions in adversary capability, while PER provides the mechanism for validating and measuring those reductions.
Together they establish a repeatable engineering process for attack-path discovery, prioritization, elimination, and measurement.
A reference implementation of how to calculate PER is available at (https://github.com/OWASP/OWASP-Subtractive-Hardening-Top-10/tree/main/PER).
The project is based upon the principle that security controls do not provide equal levels of risk reduction.
The hierarchy reflects a simple principle:
Architectural Deletion > Architectural Constraint > Monitoring
Whenever an attack path can be eliminated, elimination is preferred. If elimination is not feasible, the path should be constrained. Monitoring is reserved for residual paths that cannot be removed or sufficiently constrained.
Subtractive Security prioritizes:
Remove attack paths entirely.
Examples:
Constrain attack paths that cannot be eliminated.
Examples:
Monitor the residual risk that cannot be deleted or constrained.
Examples:
This hierarchy reflects the project's belief that the elimination of an attack path is generally more effective than detecting its use as described in the Assumption Burden Principle.
The OWASP Subtractive Hardening Top 10 is a family of platform-specific security engineering standards operating under a common set of universal architectural laws.
At the foundation of the framework is the OWASP Universal Subtractive Security Laws Top 10, which defines platform-agnostic attack-path reduction principles applicable across operating systems, cloud platforms, identity systems, SaaS environments, networks, embedded devices, and future technology domains.
Environment-specific standards provide reference implementations of these universal laws within particular technology stacks.
The OWASP Subtractive Security Top 10 Project includes governance standards that operationalize attack-path reduction within security programs.
These standards provide guidance for managing risk where attack paths cannot yet be eliminated, prioritizing remediation work according to attacker capability reduction, and governing external relationships that introduce new attack paths.
Published Governance Standards:
Together these standards transform attack-path reduction from an architectural framework into a practical security operating model.
