| Mitigation | Version Sprawl | Environment Exposure | Undocumented Endpoints |
|---|---|---|---|
| MIT 01 Complete inventory | ✓ Reveals all versions | ✓ Lists all environments | ✓ Surfaces undocumented |
| MIT 02 Deprecation process | ✓ Enforces version shutdown | — Not directly | — Not directly |
| MIT 03 Network restriction | ✓ Blocks old versions immediately | ✓ Blocks staging from internet | ✓ Blocks undiscovered paths |
| MIT 04 Same controls all versions | ✓ v1 gets v2’s security controls | — Environment-level issue | ✓ Undoc endpoints get auth |
| MIT 05 Environment separation | — Not directly | ✓ Removes staging from internet | — Not directly |
| MIT 06 Discovery scanning | ✓ Finds forgotten versions | ✓ Finds exposed environments | ✓ Finds undocumented paths |
| MIT 07 API gateway | ✓ Old versions blocked at gateway | ✓ Backends inaccessible directly | ✓ Only registered routes allowed |
If you can only implement three: MIT 01 (inventory — you need to know what exists), MIT 03 (network restriction — immediate attack surface reduction), and MIT 07 (API gateway — structural enforcement of visibility). Discovery scanning (MIT 06) should follow closely as the feedback loop that keeps MIT 01 accurate.