The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Subtractive security means reducing unnecessary exposure: excess access, reusable credentials, public entry points, legacy authentication, and functionality that creates avoidable risk. It is a useful label for established practices—not a formally defined or standardized framework. In 2026, current guidance and vendor initiatives put renewed emphasis on these practices, but available evidence does not quantify industry adoption of the phrase or prove a separate movement.
What subtractive security means
The idea is to improve security not only by adding controls, but also by removing things attackers could exploit. NIST describes attack-surface reduction as “a means of reducing risk to organizations by giving attackers less opportunity to exploit weaknesses or deficiencies (i.e., potential vulnerabilities) within systems, system components, and system services.” The statement appears in NIST SP 800-53 Revision 5.1.
As an Amazon Associate I earn from qualifying purchases.
In practice, subtraction can mean removing unnecessary administrative privileges, replacing reusable workload secrets, closing public endpoints, disabling older authentication paths, or turning off unneeded functionality. These actions draw on established ideas such as least privilege, least functionality, and secure configuration; “subtractive security” is a framing for them, not a newly established standard.
Why the idea is gaining attention in 2026
Recent guidance and initiatives converge on reducing exposure and limiting the damage an attacker can cause. Microsoft’s April 20, 2026 security article addresses eliminating credentials and reducing exposed endpoints to make opportunistic attacks harder. Its July 2026 Secure Future Initiative update describes reducing blast radius through eliminating legacy systems, securing tenant boundaries, enforcing least privilege, and hardening against lateral movement. Microsoft’s 2026 Digital Defense Report also recommends reducing oversharing and using sensitivity-aware and least-privilege controls.
#1 Best Overall
- ENDLESS POWER FROM SOLAR ENERGY: Just 45 minutes of direct sunlight powers the camera for a full day of use, while the built-in battery lasts up to 180 days on a single charge during cloudy days. Solar charging requires temperatures above 32°F.△
- EASY WIRE-FREE INSTALLATION: Place the Tapo SolarCam C402 KIT where you need it without relying on nearby outlets. Install the camera and solar panel together or separately using the included 13 ft cable for flexible placement.
- PRIORITIZE WHAT MATTERS: Set activity zones to monitor specific areas for motion or people. Free person and motion detection helps reduce unwanted alerts and notifies you when activity is detected.
- VERSATILE VIDEO STORAGE: Store footage locally via a microSD card (up to 512GB)* or via cloud with a Tapo Care cloud subscription. Tailor your security to suit your needs, whether indoor or outdoor, you have the storage option you need.
- FULL-COLOR 1080P, DAY AND NIGHT: See clearly in low light with a large-aperture lens and built-in spotlights. Capture full-color night vision up to 30 ft away to monitor for possible intruders or motion.
These are vendor publications: they demonstrate current emphasis, not market-wide adoption of the phrase or a measured industry trend. The July SFI update reports that phishing-resistant MFA enforcement reached 99.97% user and device coverage in Microsoft’s own program. That is a Microsoft program figure, not an industry rate, and it does not show that subtractive security caused the result.
What organizations can remove or reduce
Reusable secrets and credentials
Where workloads support them, replace stored or reusable secrets with managed identities or federated identity patterns. Fewer reusable secrets mean fewer credentials that can be phished, guessed, reused, or leaked. Plan the change around each workload’s identity-provider support, permissions, and recovery needs; do not remove a credential until its dependencies and replacement path are verified.
Rank #2
- Outdoor 4 is our most affordable wireless smart security camera yet, offering up to two-year battery life for around-the-clock peace of mind. Local storage not included with Sync Module Core.
- See and speak from the Blink app — Experience 1080p HD live view, infrared night vision, and crisp two-way audio.
- Two-year battery life — Set up in minutes and get up to two years of power with the included AA Energizer lithium batteries and a Blink Sync Module Core.
- Enhanced motion detection — Be alerted to motion faster from your smartphone with dual-zone, enhanced motion detection.
- Person detection — Get alerts when a person is detected with embedded computer vision (CV) as part of an optional Blink Subscription Plan (sold separately).
Excess privileges and accounts
Apply least privilege to identities and token scopes, remove unneeded administrative assignments, and periodically review accounts in administrative roles. Microsoft’s identity guidance recommends removing accounts that no longer need those roles. Changes should preserve the access required for normal duties, emergency recovery, and accountable administration.
Legacy authentication paths
Disable older, less secure protocols and block legacy authentication methods that prevent modern identity risk evaluation, where users and applications can move to supported alternatives. Inventory affected clients and integrations first; a legacy path may still be a hidden dependency for a service or recovery process.
Rank #3
- 【2K High Definition】Capture every detail inside your home with crystal-clear 2K high definition video with this indoor security camera. Easily see what your baby is holding or what your pet is playing with.Controller Type:Amazon Alexa;Android;Google Assistant.Connectivity protocol:Wi-Fi.Power source type:Corded Electric, Power Adapter: 100–240 V. Connects via 2.4GHz Wi-Fi Band
- 【Up, Down, All Around】This Pan/Tilt camera see everything across an entire room or walkway with the 360° horizontal and 114° vertical range pan/tilt field of view.
- 【Detection & Instant Notification】Get instant push notifications when motion, person or baby crying is detected, there is no additional fee to use it as a baby camera monitor. Discern from notifications that matter, so you'll know if its your pet playing around or if someone is actually there.
- 【Works w/ Alexa & Google Assistant】Fully compatible with Amazon Alexa and Google Assistant, use your simple voice command to view Tapo indoor security camera live stream on Echo Show or Google Chrome Cast with a screen. Streaming via Google limited to display on Chromecast & Nest devices only.
- 【2-Way Audio w/ Built In Siren】Never truly leave home with the built-in 2-way audio. Use as a pet camera with phone app to comfort your pet from anywhere in the world. Keep your family safe with cameras for home security indoor by warding off intruders.
Public endpoints and administrative ports
For suitable architectures, consider private endpoints for data planes and brokered access instead of inbound administrative ports exposed to the internet. These are options, not universal requirements: network design, administrator workflows, availability needs, and incident procedures determine whether they fit.
Unneeded functionality and vulnerable interfaces
NIST’s attack-surface reduction guidance includes using least functionality, reducing code that executes and unauthorized entry points, deprecating unsafe functions, and eliminating vulnerable APIs. Identify what a system actually needs before disabling components or interfaces; removing a dependency blindly can break a service without reducing meaningful exposure.
Rank #4
- 【2K Resolution & Color Night Vision】This 2K Ultra HD security camera is designed for indoors and outdoors. You can choose to install indoor and outdoor cameras for home security in the kitchen, living room, bedroom, baby room, yard, garage, etc. You can not only capture high-definition surveillance footage through the security camera outdoor during the day, but also see colorful images at night. The outdoor camera provides comprehensive and multi period services for your home security.
- 【Two-way Talk & Motion Detection】The outdoor security camera is equipped with a noise-canceling microphone and speaker. You can have a remote talk with family, pet or unexpected visitor on the wifi camera side through the phone app. The house cameras with audio and video will bring you an unexpected user experience. Once the motion is detected, the indoor camera will send you a notification via the phone app. If strangers break into home, the built-in siren will help you deter the intruders.
- 【IP65 Waterproof & Easy to install】The outdoor cameras for home security, which have an IP65 waterproof design, so in any weather, there is no need to worry about the outdoor cameras being damaged. The security camera outdoor with dust and water resistance that can be easily installed on walls, shelves, trees, roofs, and other places you want, helping you to keep an eye on your home security anytime and anywhere.
- 【24/7 SD Card Storage & Optional Cloud】 The wifi outdoor camera features in-app 10s alert video clips or pictures. It also supports TF card (up to 128GB, not included) or cloud storage (with a 30-day trial). Both storage ways allow for 24/7 continuous recording, ensuring that you can play back your videos whenever you want. This indoor camera also has advanced encryption technology to protect your privacy, so even if the home security cameras are stolen, no one can access your recorded videos.
- 【Work with Alexa Assistance】The cameras for home security, which can also work with Alexa assistant. If you have third parties at home, you can connect the wifi camera with them, use your simple voice command to view the indoor security camera live stream on Echo Show or other Alexa devices with a screen. Easily get your home security footage up on a larger TV display.
How to implement reductions without creating outages
- Set a specific risk objective. Decide which exposure to reduce—such as standing admin access, stored secrets, or internet-reachable management ports—and how you will know the change worked.
- Inventory assets and dependencies. Map identities, workloads, endpoints, integrations, users, vendors, and recovery paths that rely on the access or feature under review.
- Choose a supported replacement. Confirm that the alternative authentication, access route, or configuration works for affected systems and operators.
- Stage the change. Pilot with a limited scope, maintain an exception process for documented dependencies, and define rollback steps before broad rollout.
- Validate and monitor. Test normal operations and recovery, verify the intended configuration, and watch for unauthorized changes or configuration drift.
- Measure the outcome. Track exposure reduced, detection coverage increased, and time to mitigate—not simply the number of tools removed or patches deployed.
NIST’s security configuration checklist guidance describes checklists as instructions and procedures for setting a product to a chosen risk posture, checking configuration, detecting unauthorized changes, and producing posture evidence. It supports treating configuration as something to verify and maintain, not a one-time cleanup.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How to compare reduction options
| Measure | Exposure reduced | Operational question | Evidence to track |
|---|---|---|---|
| Managed identities or federation | Reusable workload secrets | Can each workload authenticate and recover without its existing secret? | Secrets retired and workloads successfully using the replacement identity |
| Least privilege and account review | Excess permissions and unnecessary privileged accounts | Do users and recovery procedures retain the access they genuinely require? | Unneeded assignments removed and access reviews completed |
| Blocking legacy authentication | Older authentication paths | Which users, applications, or services still depend on those methods? | Legacy paths disabled and remaining exceptions documented |
| Private endpoints or brokered administration | Public data-plane endpoints or inbound administrative ports | Does the architecture support the access route and maintain service availability? | Public exposure reduced and access routes tested |
| Least functionality and secure configuration | Unneeded code, entry points, unsafe functions, or vulnerable interfaces | Are dependencies known, and can the configuration be checked for drift? | Configuration verified and unauthorized changes detected |
What the 2026 evidence does—and does not—show
NIST supports the underlying practice of reducing attack surface, while Microsoft’s 2026 publications offer current examples involving credentials, endpoints, legacy systems, privileges, and blast radius. Together, they make the topic timely. They do not establish “subtractive security” as a formal framework, show how widely organizations use that label, or provide an independent measure of adoption across the cybersecurity industry. Treat it as a practical way to describe a set of established risk-reduction choices.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
