Glossary
Your attack surface is the sum of every point where an attacker could try to enter or extract data from your environment — especially everything exposed to the internet.
Definition
An attack surface is the total set of points — assets, services, interfaces and entryways — through which an unauthorised attacker could attempt to access or exfiltrate data from a system or organisation. The external (or internet-facing) attack surface is the portion reachable from the public internet: domains, IPs, cloud services, APIs and applications. As organisations adopt cloud, expand through acquisitions and accumulate shadow IT, their attack surface grows continuously — often faster than security teams can track.
Why it matters
Every new domain, cloud resource, API or third-party integration adds to your attack surface. Much of it is unknown to security teams — and an unknown, internet-facing asset is the easiest way in for an attacker.
Components
Every domain and subdomain tied to your organisation.
Public resources across AWS, Azure and Google Cloud.
Known and unknown internet-facing API endpoints.
Public apps, portals and login pages.
Open ports, databases and admin interfaces.
Forgotten and unmanaged internet-facing assets.
How it works
Continuously map your full external footprint, known and unknown.
Assess each asset for vulnerabilities and exposures.
Rank by real-world, exploitable risk.
Remediate and keep monitoring as the surface changes.
Related
FAQ
It is the total set of points through which an attacker could try to access or extract data — especially everything exposed to the internet.
The internal attack surface is reachable from inside a network; the external attack surface is reachable from the public internet.
By continuously discovering all assets, assessing them for exposure, prioritising by risk and remediating — the goal of attack surface management.
Cloud adoption, acquisitions, third parties and shadow IT constantly add new internet-facing assets.
Get the attacker’s view of everything you expose to the internet.
