OWASP’s subtractive security project measures the attack paths you erased

An attacker who talks a user into opening an attachment gets whatever that machine still permits: a service account with rights across the domain, an outboun...