OWASP Subtractive Security Scores What You Remove

A Security Metric That Goes Down When You Do Well

OWASP has launched the Subtractive Security Top 10, a project that measures defensive progress by counting the attack paths an organisation has removed rather than the vulnerabilities it has detected. Help Net Security covered the launch on August 4, 2026. Project founder Christopher Frenz leads the initiative, and the lists and specification are published on GitHub under OWASP's open source licence.

• Nine separate lists covering Windows, Linux, macOS, Active Directory, AWS, M365, network, and IoT, with a universal list of foundational principles underneath
• Path Erasure Rate (PER) 1.0, an engineering standard expressing security as paths erased divided by paths eligible for erasure
• A stated hierarchy of efficacy — erase the path first, constrain it architecturally if erasure is impossible, and monitor only as a last resort
• Explicitly not maximalist — the project states plainly that some attack paths serve legitimate business purposes and should remain

Why Invert the Usual Model?

Because the default response to a security problem is to add something, and additions accumulate.

Most programmes answer risk with another control: a new agent, a new alert rule, a new logging pipeline, a new dashboard. Each is individually defensible. Collectively they produce a large detection estate sitting on top of an attack surface that has not shrunk at all. The adversary's set of available moves is exactly what it was; there are simply more observers watching them make it.

Subtractive Security asks a structural question instead: what can be removed to make this attack materially harder or impossible? An unused local administrator account that has been deleted cannot be abused, and it generates no alerts, no tuning work, and no analyst time forever. A legacy remote access protocol that has been disabled has no CVEs in your environment.

The framing is not novel to practitioners who have done hardening work for years. What is new is a shared vocabulary and a published metric, which is what turns a good instinct into something a team can be measured on.

How Path Erasure Rate Works

PER is deliberately blunt. It is the fraction of eligible attack paths that have actually been erased, and Frenz has said the metric is binary on purpose to make it hard to game — either a path exists or it does not.

That design decision is doing quiet but important work. Most security metrics are continuous and therefore negotiable: coverage percentages, mean time to detect, risk scores that shift when you change the weighting. A binary per-path measure resists that. You cannot partially delete an account.

The denominator — paths *eligible* for erasure — is where judgement lives, and the project is candid that it should. Some paths exist because the business needs them. The point of the eligibility set is to force an explicit decision about each one, rather than letting an unexamined path persist because nobody ever asked.

What It Looks Like in Practice

The project's ransomware-relevant examples are the kind of work most teams have on a list somewhere and rarely finish:

• Removing unused local administrator accounts
• Disabling legacy remote access protocols
• Restricting east-west traffic between network segments
• Pruning excess cloud identity permissions

None of these are exciting, and all of them close off categories of movement that detection tooling would otherwise have to catch in flight. The hierarchy of efficacy — erasure, then architectural constraint, then monitoring — borrows directly from reliability engineering, where designing out a failure mode has always outranked alerting on it.

Why This Matters for AI Security Specifically

Agentic systems have made the case sharper. An AI agent with broad standing permissions is, in this vocabulary, a very large set of attack paths granted in advance. The subtractive question — which of these permissions can simply be removed — is a considerably better first move than instrumenting the agent and watching what it does with them.

That is the same instinct behind tooling like NVIDIA's SkillSpector scanner for agent skills, and it complements trust-scoring work such as CISA's C4 framework for open source projects. Readers following our AI security coverage will notice the consistent theme through 2026: reduce what the system is allowed to do before investing in watching what it does.

Getting Started

The nine lists and the PER 1.0 specification are on GitHub under OWASP's open source licence, which means a team can pick the list matching their largest platform and start scoring this week. The most useful first exercise is usually the least technical one — enumerate the eligible paths honestly, including the ones that will stay, and see what the denominator actually looks like.

Sources: Help Net Security — August 4, 2026; CyberPress — August 2026; OWASP Foundation — 2026.