Your attack surface is the sum of every point an attacker could use to get in or cause harm, across your internet-facing systems, internal systems, applications, APIs, identities and people. It grows constantly as you add services and change. Understanding and reducing it is the foundation of modern security, because you cannot defend what you cannot see.
What an attack surface is
Your attack surface is every possible way an attacker could get into your organisation or cause it harm. Every internet-facing server, every application, every API, every account, every person who could be tricked, all of it adds up to your attack surface. The larger it is, the more opportunities an attacker has. The smaller and better understood it is, the harder you are to attack.
Thinking in terms of attack surface reframes security usefully. Rather than asking whether any single thing is secure, you ask what an attacker could reach and use, across everything you have. That is the question attackers themselves ask, so answering it first is how you stay ahead of them.
The main parts
An attack surface has several distinct parts, and a complete view considers all of them:
- The external attack surface: everything reachable from the internet, such as websites, servers, VPNs and cloud services
- The internal attack surface: the systems and paths an attacker can use once inside your network
- The application attack surface: the weaknesses in your web apps, APIs and software
- The identity attack surface: accounts and credentials, both human and machine, that can be compromised
- The human attack surface: your people, who can be targeted through phishing and social engineering
Each part is a different avenue of attack, and attackers combine them. A phished credential leads to an application flaw, which leads to internal movement. A realistic view of your risk covers the whole surface, not just one part.
Why the attack surface keeps growing
One of the defining challenges of modern security is that the attack surface never stops growing. Every new cloud service, every integration between applications, every new API, every device and every staff member adds to it. Organisations adopt technology faster than they can track it, and each addition is another potential way in.
This constant growth means the attack surface is not something you map once. It is a moving target. What you exposed last month is not what you expose today, and the gap between the two is where risk accumulates unnoticed.
Known versus unknown attack surface
The most dangerous part of the attack surface is the part you do not know about. Organisations can usually account for their intended, documented assets. What they struggle with is the unknown: the forgotten server, the subdomain pointing at an old service, the cloud resource stood up for a project and never decommissioned, the shadow API nobody documented.
These unknown assets are the ones attackers love, because they are exposed but unmonitored and unmaintained. No one is patching them, watching them or protecting them, precisely because no one remembers they exist. Finding your unknown attack surface is often where the biggest risk reductions come from.
Why you cannot defend what you cannot see
This leads to the central truth of attack surface management: you cannot defend what you cannot see. Every security control you apply, patching, monitoring, access control, only covers the assets you know about. The assets you have lost track of get none of that protection, which makes them the soft targets.
This is why visibility comes first. Before you can reduce your attack surface, you have to see it fully, including the parts that have slipped out of view. An accurate, current picture of everything you expose is the foundation everything else builds on.
Reducing and managing your attack surface
Once you can see your attack surface, you can manage it. The goal is twofold: reduce it, and monitor what remains. Reducing it means removing what does not need to be exposed, closing unnecessary services, decommissioning forgotten assets, tightening access. A smaller attack surface is simply harder to attack.
Monitoring what remains means keeping the picture current as things change, and understanding which exposures actually matter. The strongest approach goes beyond listing exposures to validating which are genuinely exploitable, so effort focuses on real risk rather than everything at once. And because the attack surface grows continuously, this has to be an ongoing practice, not a one-time exercise.
To see and reduce your full attack surface, including the unknown assets, explore our attack surface management platform, or read what EASM is for a deeper look at the external part.
For a wider reference on attack surface, see recognised sources such as NIST or MITRE.
Frequently asked questions
What is an attack surface?
Your attack surface is the sum of every point an attacker could use to get into your organisation or cause harm, spanning internet-facing systems, internal systems, applications, APIs, identities and people. The larger it is, the more opportunities an attacker has.
What are the parts of an attack surface?
The external surface reachable from the internet, the internal surface reachable once inside, the application surface in your apps and APIs, the identity surface of accounts and credentials, and the human surface of your people. Attackers combine these.
Why does the attack surface keep growing?
Because every new cloud service, integration, API, device and staff member adds to it, and organisations adopt technology faster than they can track it. The attack surface is a moving target, not something mapped once.
How do you reduce your attack surface?
First see it fully, including unknown and forgotten assets, since you cannot defend what you cannot see. Then remove what does not need to be exposed, tighten access, and continuously monitor and validate what remains to focus on real, exploitable risk.
