Attack surface

What is an attack surface?

An attack surface is the set of places an attacker can interact with your systems. NIST SP 800-53 defines it as the set of points on the boundary of a system or environment where an attacker can try to enter, cause an effect, or extract data. The OWASP Attack Surface Analysis Cheat Sheet adds the application view: every path for data and commands into and out of the software, the code that protects those paths, and the valuable data behind them.

Size is not the only property that matters. An attack surface that is small but unknown, a forgotten staging host or an old API version, is often worse than a larger one that is fully inventoried, because nobody is patching or monitoring what nobody knows exists.

What are the types of attack surface?

Attack surface is usually split two ways: by where the attacker starts, and by what they interact with.

External vs internal. The external surface is what anyone on the internet can reach without credentials: public IPs, DNS names, web apps, APIs, VPN gateways, email servers, exposed storage buckets. The internal surface is what becomes reachable after a foothold: file shares, directory services, internal admin panels, databases, CI/CD systems, cloud control planes reached with stolen keys. External testing and internal testing measure these separately.

Digital, physical and human.

The categories overlap. A help desk that resets MFA over the phone is a human surface that leads straight into the digital one.

Attack surface vs attack vector

The attack surface is where an attacker can interact. An attack vector is how they get in through one of those points: a phishing email, a password spray against the VPN portal, an injection in a public API. One exposed service is a single point on the surface that may support several vectors.

CVSS captures the vector at a coarse level. Its Attack Vector metric records whether a vulnerability is exploitable over the Network, from an Adjacent network, Locally, or only with Physical access. That tells you which part of the surface a given CVE threatens: an AV:N flaw matters most on your external surface.

How is an attack surface enumerated?

Enumeration starts from what you know you own and expands until new searches stop finding new assets. A typical external-discovery procedure, shown against the placeholder domain acme.example.

1. Collect seeds. Registered domains, company and brand names, IP ranges and ASNs, cloud account and subscription IDs, code organizations. Domains from acquisitions and marketing campaigns are easy to miss.
2. Pull names from certificate transparency. Public CAs log issued TLS certificates to append-only, publicly auditable CT logs (RFC 9162), so every hostname that ever got a public certificate is discoverable, including ones never linked anywhere.
3. Expand through DNS. Resolve every name, follow CNAMEs, check MX, TXT and NS records, and add candidates from passive DNS datasets and wordlist brute-forcing. A CNAME pointing at a deprovisioned cloud resource is a subdomain takeover candidate.
4. Pull the cloud inventory from the source. Cloud APIs list what exists whether or not DNS points at it: AWS Resource Explorer, Azure Resource Graph and Google Cloud Asset Inventory all do this. Public IPs with no DNS name, and names with no owner, both need an explanation.
5. Identify live services. Port-scan the resolved IPs you are authorized to test, then fingerprint what answers: web servers, SSH, RDP, database ports, VPN and firewall management interfaces.
6. Discover APIs. Collect OpenAPI and GraphQL schemas, read JavaScript bundles and mobile apps for endpoint paths, check gateway logs, and probe for old versions such as /v1/ alongside /v2/. OWASP ranks improper API inventory as API9:2023; undocumented endpoints are shadow APIs.
7. Record owner, exposure and purpose for every asset. An asset without an owner is the one nobody will patch when a zero-day lands in it.

Step 2 in practice, using the public crt.sh search over CT logs:

curl -s 'https://crt.sh/?q=%25.acme.example&output=json' \
  | jq -r '.[].name_value' | tr 'A-Z' 'a-z' | sort -u

acme.example
api.acme.example
legacy-api.acme.example
staging.acme.example
vpn.acme.example

Names like legacy-api and staging are the ones worth chasing first: they were important enough to get a certificate and are often missing from the official inventory.

Step 4 in AWS, searching one region's EC2 instances with Resource Explorer:

aws resource-explorer-2 search --query-string "resourcetype:ec2:instance region:us-east-1"

Enumeration is not a one-time project. For U.S. federal civilian agencies, CISA BOD 23-01 requires automated asset discovery every 7 days and vulnerability enumeration across discovered assets every 14 days, a useful benchmark for how fast inventories go stale.

How do you reduce an attack surface?

Reduce what is exposed, then make what remains known and defended. Removal comes first, because a deleted service needs no patching or monitoring.

1. Delete what is unused. Decommission old hosts, API versions and test environments, and remove their DNS records at the same time.
2. Take administrative interfaces off the internet. Firewall, VPN, hypervisor and database management should be reachable only from a management network or through an access proxy.
3. Require authentication by default. A new endpoint should be private until someone decides it is public.
4. Disable features you don't use. Default modules, sample apps, debug endpoints and unused protocols all add surface for nothing.
5. Segment internally. Limit what a compromised laptop or web server can reach, which shrinks the internal surface that matters after a breach.
6. Harden the human surface. Phishing-resistant MFA and help desk identity checks for resets close the most common human vectors.
7. Review changes, not just inventories. The OWASP cheat sheet's advice is to ask of each change what is new and what holes it could open: a new interface or technology adds far more surface than another endpoint built on an existing pattern.

Testing closes the loop. An inventory tells you what exists; a penetration test shows which parts of it an attacker can actually use.

Written by Parameter · Last reviewed September 27, 2026