# A Control Inside the System It Protects Falls With It ## Claim A control that runs inside the system it defends can be disabled by whoever compromises that system, so its protection is conditional on the system staying uncompromised in the first place. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds for any control co-located with what it protects: an in-process security plugin, an in-process monitoring agent, an EDR agent running on the host it watches, an application-level rate limiter, a local audit log an attacker with write access can edit or truncate. - Strongest exactly at the moment the control matters most — after an attacker already has enough access to threaten the system — because that is also the moment the control becomes disableable. - Breaks down where the control's enforcement point is genuinely out-of-band: a cloud WAF filtering traffic before it reaches the origin, a remote log-shipping pipeline the attacker's access can't reach, a signed update channel the compromised host doesn't control. - Does not argue against in-process controls entirely — detection and convenience still have value — only against treating them as a security boundary equivalent to an out-of-band one. ## Evidence > [!quote] ID:rw_01m1s3h636csf5z85k9y6yc047 > If an attacker gains file write access, they can deactivate a security plugin. They cannot deactivate infrastructure that is not running on your server. Sucuri's own guide to choosing a WordPress security plugin names this as the property most site owners underestimate when comparing a plugin firewall to a cloud WAF: a plugin runs inside WordPress, after PHP has already booted, so an attacker who reaches file-write access can simply turn it off. A cloud WAF sits outside that boundary and can't be reached the same way. The vendor states this plainly even though the conclusion favors their own product category — which is what makes the underlying architectural claim credible independent of the sales pitch built on top of it. ## Links - [[3. Resources/Permanent Notes/A Single Discretionary Update Channel Is a Security Dependency]] — because contrasts; that note is about a *centralized* channel becoming a single point of failure, this note is about a *co-located* control becoming disableable by the thing it defends — opposite failure modes, both about where a control actually sits relative to what it protects. - [[3. Resources/Permanent Notes/Security Controls Are Configurations Not Purchases]] — because extends; both from the same source, and both push past "which product" toward "where and how the control actually operates." - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — because applies-in; a direct evaluation criterion for any control being added to a hosting security stack — ask whether it survives the compromise it's meant to catch. ## Tests / falsifiers - Find a documented incident where an in-process security control caught and stopped an attacker who already had file-write access, without the attacker being able to disable it first. That would weaken the claim's strength, if not its structure. - Check whether any popular WordPress security plugin ships a self-protection mechanism that survives an attacker with file-write access (e.g., a heartbeat to an external service that alerts on the plugin going silent) — if common, the practical exposure this claim describes is smaller than stated. ## Source - [[3. Resources/Readwise/Full Document Contents/Articles/WordPress Security Plugins How to Choose the Right One]] — Sucuri vendor guide, 2026-09-05. Vendor content; Sucuri is GoDaddy-owned and sells both the plugin and the cloud WAF this comparison favors — disclose both facts before citing publicly.