What is Attack Surface?

An attack surface is the complete set of points where an attacker could attempt to gain access to a system or organisation. Every open port, exposed application, API endpoint, login page, email address, and misconfigured cloud bucket is part of it. The larger and less well-understood the attack surface, the more opportunities an attacker has.

Types of attack surface

• External (digital) attack surface — everything reachable from the public internet: domains, subdomains, open TCP ports, web applications, VPN gateways, and cloud services
• Internal attack surface — systems reachable only from inside the network, relevant once an attacker has a foothold
• Human attack surface — people who can be phished, socially engineered, or impersonated via techniques like typosquatting

Why the external attack surface matters most

The external attack surface is what opportunistic attackers scan first, because it requires no prior access. Forgotten development servers, exposed admin panels, and dangling DNS records are routinely found by automated reconnaissance within hours of appearing online.

Managing it

You cannot reduce what you cannot see. External attack surface management tools map the external attack surface continuously, so organisations can remove unnecessary exposure and fix weaknesses in what must stay online.