Why Deleting Attack Paths Beats Just Watching Them

Wed, 05 Aug 2026 08:50:54 +0900

🤔 What Is It?

OWASP subtractive security

Subtractive security means removing or restricting the actual paths an attacker could use — unused accounts, old protocols, excess privileges, unnecessary network exposure — instead of just adding more monitoring tools to watch for trouble. OWASP’s new Subtractive Security Top 10 argues that deleting a risky path is more effective than merely detecting when someone uses it.

🧩 Like clearing an overgrown backyard instead of installing more cameras

Imagine a backyard with overgrown bushes hiding the fence line, a side gate that never locks, and a shed door that won’t quite close. One option is to bolt on more security cameras and motion sensors so you get an alert every time someone sneaks through. That’s useful, but the bushes, the broken gate, and the loose door are still there, waiting to be used. A smarter homeowner trims the bushes, fixes the lock, and repairs the door — removing the actual ways in, so there’s far less left to watch for in the first place. That “fix the yard, not just the cameras” instinct is exactly what OWASP’s subtractive security recommends for computer systems.

Web-Security on Explain It

Why Deleting Attack Paths Beats Just Watching Them

🤔 What Is It?

🧩 Like clearing an overgrown backyard instead of installing more cameras