Definition

Attack surface

Your attack surface is the full set of points where an attacker could try to enter your systems or extract data. It includes public-facing web apps, exposed ports, cloud storage buckets, employee laptops, third-party integrations, and even staff who might fall for a phishing message. The larger and less visible the surface, the more places something can go wrong, so security teams work to map it fully and then shrink it by closing unused services and tightening access. You cannot defend what you have not accounted for, which is why attack surface discovery is often the first step in a serious security review.