What is an attack surface?
An attack surface is every entry point an attacker could leverage to get into an organization's systems.
TL;DR
- An attack surface is the full set of entry points attackers could exploit — applications, servers, ports, subdomains, leaked emails and credentials.
- It grows with every new asset, vendor, and service — which is why it needs continuous monitoring.
- Reducing the attack surface means finding and closing exposures before attackers do.
Short definition
An attack surface is the total set of weaknesses and entry points — applications, servers, ports, subdomains, leaked emails and credentials — that attackers could exploit to access systems or data.
Why is your attack surface bigger than your website?
A company's attack surface is far larger than its main website. Old subdomains, exposed admin portals, servers running outdated TLS, and employee credentials circulating on the darknet are all part of the surface that attackers can explore automatically.
That is why attack surface measurement is done from the outside — the same way an attacker maps a target. The larger and less monitored the surface, the more likely a gap is found before the security team notices it.
What are some practical examples?
- An old vendor subdomain that is still live but no longer monitored by IT.
- A company admin portal reachable from the public internet without layered authentication.
- Employee login credentials appearing in breach data, enabling repeated access.
Learn more
Frequently asked questions
Related terms
Get your free security rating
Run a free CyberRank security rating for any organisation and see the same vendor risk signals our customers use.
Get your free security rating