Attack Surface

An attack surface is the total set of entry points and exposures that an attacker could target: open ports, web endpoints, APIs, login forms, third-party integrations, employee accounts and even physical access points.

Why it matters

Every exposed service, feature or account is something that must be configured, patched and monitored. The larger the surface, the more chances for a mistake. Reducing it is among the most effective security measures: remove what is unused, restrict what is internal and limit what is public. Forgotten assets, such as an old test server or an abandoned subdomain, are common weak points.

Example

An inventory of a small company finds a staging site, an old admin panel and an unused database port reachable from the internet. Taking the staging site behind a login, retiring the panel and closing the port shrinks the surface without changing the product.

Common mistakes

• Not knowing what is exposed because there is no up-to-date asset list.
• Adding features and integrations without reviewing the new exposure.
• Forgetting non-technical surfaces such as staff, suppliers and offices.
• Leaving dangling DNS records pointing at services that no longer exist.

Related

• Subdomain takeover
• Hardening
• Least privilege
• Threat modeling
• Tool: Port checker

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.