Attack Surface
Attack surface is the set of entry points an attacker can target.
Updated: 2026-03-05
Definition
Attack surface includes exposed ports, services, user accounts, applications, APIs, and misconfigurations.
Reducing attack surface means disabling unused services, patching, and limiting access.
Key points
- More exposure = more risk
- Reduce by hardening and least privilege
- Visibility and inventory are essential
Common mistakes
- Leaving unused services running.
- No asset inventory (unknown exposure).
Related exams
Related terms
Want to practice this in exam-style questions?
Use the mini tests on each exam page, then continue in the app for offline packs and detailed explanations.
Go to exams