Attack Surface

What is Attack Surface?

An attack surface is the total of all the points where an unauthorized user could try to enter or extract data from your environment. It includes every device, user account, application, and network connection you have, and the larger it is, the more opportunities an attacker has to find a way in.

How It Works

Your attack surface is made up of every possible entry point across your organization. These generally fall into a few categories: your devices, such as laptops, servers, and phones; your software, including applications and cloud services; your people, whose accounts and credentials can be targeted; and your network, including every connection to the outside world.

Each of these points is something an attacker can probe. An unpatched application, a device without multi-factor authentication, a forgotten cloud account, or an untrained employee all add to the surface an attacker can exploit.

The surface tends to grow quietly over time. Every new tool, device, vendor connection, and employee expands it, often without anyone tracking the change. This is why organizations that do not actively manage their attack surface usually have far more exposure than they realize.

Why It Matters

The larger your attack surface, the harder your organization is to defend, because you must protect every single point while an attacker only needs to find one weakness. Reducing the attack surface, by removing unused accounts and software, patching systems, enforcing strong access controls, and segmenting networks, directly lowers your risk. Knowing your full attack surface is the starting point for defending it.

Related Terms

• What Is a Vulnerability?
• What Is Network Segmentation?
• What Is Access Control?
• What Is a Threat Actor?

For a complete guide, read our full article on how medical clinics actually get breached.

SecTec helps organizations map and reduce their attack surface, starting with our free risk assessment.