What is Attack Surface?

An attack surface is the total number of points where an unauthorised user could attempt to enter or extract data from a system or environment. This includes network interfaces, APIs, web applications, user accounts, physical access points, and any other entry points. Reducing the attack surface by removing unnecessary services, closing unused ports, and applying least-privilege access controls is a fundamental security practice.