Subtractive security is a defensive design approach that reduces risk by removing unnecessary access, services, permissions, and pathways before an attacker can abuse them. Instead of adding more alerts or compensating controls, it asks a simpler question: what can be eliminated without breaking the business?
This matters because every extra account right, exposed port, fallback workflow, or integration can become part of an attack path. In real attacks, adversaries often chain small weaknesses together, so reducing the attack surface can prevent those chains from forming in the first place. In defense, subtractive security shows up as least privilege, service decommissioning, disabling unused features, tightening network reachability, and deleting legacy exceptions. Monitoring still matters, but it works best after exposure has been minimized.