OWASP Subtractive Security Top 10 Pushes Path Erasure as a New Model for Reducing Attack Surface

Security teams drowning in alerts may soon face a fundamental shift in strategy. OWASP’s new Subtractive Security Top 10, led by Christopher Frenz, argues that the industry’s dependence on detection tools has reached its limit — and that the only sustainable path forward is to erase attack paths outright, not monitor them after the fact.

An attacker who convinces a user to open an attachment inherits whatever capabilities the machine still allows—service accounts with domain-wide rights, outbound routes, and scripting engines ready for abuse. Frenz argues these capabilities should be removed before anyone writes a detection rule for them.

Frenz leads the OWASP Subtractive Security Top 10, a suite of nine platform-specific lists supported by an engineering standard called Path Erasure Rate (PER). After years of organizations stacking EDR, SIEM, and NDR, many now pay for alerts on attack paths they could have eliminated entirely. The lists identify which paths to remove across Windows, Linux, macOS, Active Directory, AWS, M365, network, and IoT, all grounded in universal principles.

The ranking methodology comes from reliability engineering, where failure modes are erased first, constrained second, and monitored only when necessary. Frenz applies the same hierarchy to cybersecurity: eliminate attack paths where possible, constrain those that cannot be removed, and monitor only what remains. Reducing alert noise is a core goal, improving detection fidelity by removing pathways that generate unnecessary alerts.

PER measures paths erased over paths eligible for erasure, with assessors producing denominators based on what they can enumerate. Frenz notes that perfect accuracy isn’t required—directionality matters. Eliminating a path that removes thousands of attack routes should be prioritized over one that removes only a handful, even if asset counts differ slightly between teams.

The framework requires an analytics phase before removal to understand which functions are legitimately needed and which only keep attack paths alive. The goal is not to eliminate every path, but to remove or constrain those with no business purpose. Items on each list were selected based on how much attacker optionality they eliminate in typical organizations.

Frenz also anticipates insurer and regulator interest. PER is intentionally binary and unweighted to prevent gaming: a path either exists or it does not, and validation requires proving an attack leveraging that path can no longer execute. Critical assets cannot be hidden behind categorization, because attackers don’t care whether a compromised workstation is labeled “non‑critical.”