What “attack surface” actually means

“Attack surface” is one of those phrases that gets used a lot and defined rarely. Here’s the plain version.

The short definition

Your attack surface is everything an attacker could try to reach — every system, service and account that is exposed enough to be a way in. If it can be connected to, logged into, or tricked, it’s part of the surface.

It has two halves that people tend to treat separately:

• External. What’s reachable from the internet: websites, mail servers, VPN gateways, remote-access portals, exposed management interfaces, and the services running behind them, each with a version that may or may not be current.
• Internal. What an intruder can reach once they’re inside — which, on a flat network, is often almost everything. Internal exposure is about how far a single foothold can travel.

Why a list of your domains isn’t the whole picture

Most organisations picture their attack surface as the sites and servers they know about. But an attacker doesn’t work from your list. They work from what’s actually reachable.

Two common blind spots:

• Forgotten systems. A test box, an old portal, a device someone stood up years ago. It’s still online, still exposed, and no longer on anyone’s radar. A scan based only on your known hostnames won’t see it; a sweep of the address ranges you actually own will.
• Shadow connections. A supplier’s remote access, a link between IT and OT that isn’t on the diagram, a cloud service someone signed up for. Each one adds surface.

Why it changes

The attack surface isn’t a fixed thing you measure once. New systems appear, ports get opened for a project and left open, configurations drift, and new vulnerabilities are published against software you’re already running. A picture taken once a year is out of date within weeks.

What “managing” it means

Attack-surface management is really just three habits, done continuously: see all of it (external and internal, including the forgotten parts), reduce what doesn’t need to be exposed, and watch how it changes so new exposure is caught quickly. No product is required to believe in the idea; the discipline is the point.