Essential Eight disruption map
Which mitigation removes which phase of the chain, and how much of it. Read a row to see where a single control reaches; read a column to see what actually stands in front of one phase.
| Essential Eight control | 01Recon | 02Res dev | 03Initial access | 04Execution | 05Persistence | 06Priv esc | 07Evasion | 08Cred access | 09Discovery | 10Lateral | 11Collection / C2 | Reach |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Restrict admin privileges | - | - | - | 8 ph · 2.40 | ||||||||
| Application control | - | - | - | - | - | 6 ph · 1.60 | ||||||
| Patch operating systems | - | - | - | - | - | - | 5 ph · 1.30 | |||||
| Multi-factor authentication | - | - | - | - | - | - | - | 4 ph · 1.20 | ||||
| Patch applications | - | - | - | - | - | - | - | - | - | - | 1 ph · 0.55 | |
| User application hardening | - | - | - | - | - | - | - | - | 3 ph · 0.45 | |||
| Regular backups | - | - | - | - | - | - | - | - | - | - | 1 ph · 0.10 | |
| Restrict Office macros | - | - | - | - | - | - | - | - | - | - | - | 0 ph · 0.00 |
| Controls in play | 0 | 0 | 4 | 3 | 3 | 3 | 3 | 3 | 2 | 3 | 4 | 28 pairs |
The number is the share of the phase the control removes when fully effective at ML2. Controls overlap, so the weights in one phase add to more than 100%. Phases 01 and 02 carry no control at all: the actor works on infrastructure you cannot see.
A strict allow-list with no path for unsigned or user-writable execution removes the script hosts and proxy binaries the actor leans on. Living-off-the-land still needs an interpreter that your policy permits.
Allow-listing signed binaries does not stop signed binaries. PowerShell, WMIC, mshta and ntdsutil are all approved by design, so the actor's execution blends into administrator activity.