Attack Surface Reduction Manifesto
Back to Home

Case Studies

Two kinds of story are collected here, sorted into the two groups below.

Where reduction worked — something was removed, switched off, never built, or never collected, and the outcome got better: it cost less, it broke less, or a breach that would have been enormous turned out to be small.

Where keeping it cost them — the same decision went the other way. A system, a permission, a copy of the data or a whole interface stayed because removing it was somebody’s project for next quarter, and it became the way in.

The second group is not a list of embarrassments. It is the same argument from the other direction: in almost every one of those cases the damage was bounded by what the organisation had already removed, and set by what it had not.

Every entry is tied to a primary source — the company’s own postmortem or engineering writeup, the regulator’s decision, the advisory, or the policy document itself. Where a project later published its own account of the same event, both are cited. Where a case has an awkward part, the awkward part is in the entry: a fine that was suspended, a saving that belongs to the replacement rather than the deletion, a deadline the organisation is behind on.

The domain labels on each entry say which part of the manifesto it supports. Most of them are useful in more than one place.

Browse by topic

Where reduction worked 33

Something was removed and the outcome improved: fewer systems to defend, smaller permissions, data that was never collected in the first place. These are the cases worth copying.

Where keeping it cost them 21

Something stayed when it could have gone: standing access nobody needed, data kept past any use for it, a surface that was there for the taking. These are the cases that show what the removal would have prevented.