attack surface
termsecuritycloud
Everything an attacker can reach and try: exposed services, APIs, credentials, people - the sum of ways in.
Every feature adds to it, every decommission subtracts; managing it is subtraction as a discipline.
Attack surface is everything an attacker could reach and interact with: exposed ports, APIs, authentication endpoints, third-party integrations, browser-facing code, and the humans who can be phoned. Reducing it is the cheapest security work available, because a component that is not reachable does not need to be defended, patched, or monitored.
The reason it grows silently is that expansion accompanies ordinary progress. Every feature adds an endpoint, every integration adds a trust relationship, every convenience adds a path. Nobody ever proposes to increase attack surface, and yet it increases with each sprint, which is why periodic inventory beats intention as a control.
The parts that hurt most are the ones nobody knew about. A forgotten staging environment with production data, an administrative interface exposed during a migration and never closed, a decommissioned service whose DNS record still resolves. Attackers enumerate systematically and find these reliably, which is why external discovery from the outside in, rather than from the architecture diagram, is the version of this exercise that actually works.