Definition
An attack surface is every point where an attacker could try to get into a system or extract data: exposed services, applications, cloud resources, accounts, devices and people.
What an attack surface is
Your attack surface is the sum of every point where an attacker could try to get in, extract data or cause damage. It includes the systems you know about and, just as importantly, the ones you have forgotten: an old test server, an unused API, an account that was never removed.
The larger and less understood the attack surface, the more chances an attacker has. Security teams cannot protect what they cannot see, which is why mapping the attack surface is usually the first step of any security programme or penetration test.
Types of attack surface
Digital attack surface
Everything reachable through networks and software:
- Internet-facing assets: websites, VPNs, mail servers, remote access services and exposed ports
- Web applications and APIs: including old versions and endpoints that are still live
- Cloud resources: storage buckets, virtual machines, serverless functions and their permissions
- Identities and credentials: user accounts, service accounts, API keys and tokens
- Third-party connections: suppliers, SaaS tools and integrations with access to your systems
Physical attack surface
Devices and places an attacker could touch: laptops, phones, USB ports, server rooms and office networks.
Human attack surface
The people who can be tricked or pressured into helping an attacker, for example through phishing, social engineering or stolen passwords.
External vs internal attack surface
The external attack surface is what anyone on the internet can reach. It is where most attacks start, and it changes fastest, because every new service, domain or cloud resource can add to it.
The internal attack surface is what an attacker can reach once inside your network, for example after compromising a laptop or an account. It decides how far an attacker can move and what they can reach from that first foothold.
Attack surface vs attack vector vs attack path
These terms are often mixed up:
| Term | What it means | Example |
|---|---|---|
| Attack surface | All the possible points of entry | Every exposed service, app and account |
| Attack vector | One specific way in | A phishing email or an unpatched VPN |
| Attack path | The chain of steps from entry to a target | VPN flaw → admin account → customer database |
Why the attack surface keeps growing
- Cloud adoption: new resources can be created in minutes, often outside central control
- Remote work: more devices and connections outside the office network
- SaaS and integrations: each tool adds accounts, data and access
- Faster releases: new code and endpoints ship every week
- Shadow IT: systems set up by teams without security being involved
How to reduce your attack surface
- Keep an up-to-date inventory of assets, including cloud resources and third-party access.
- Remove what you do not need: unused services, old applications, test systems and stale accounts.
- Patch and harden what remains, starting with internet-facing systems.
- Limit access with multi-factor authentication and least-privilege permissions.
- Segment networks so one compromised system does not give access to everything.
- Test it regularly: confirm which exposures are actually exploitable, then re-test after fixes.
Attack surface management
Attack surface management (ASM) is the continuous process of discovering, inventorying and monitoring the attack surface. External attack surface management (EASM) focuses on internet-facing assets; cyber asset attack surface management (CAASM) builds an inventory from the tools you already use.
ASM tells you what is exposed. Penetration testing tells you which of those exposures an attacker could actually use, and what they could reach through them.
How Plainsea helps
Every Plainsea test starts by discovering what is actually exposed within the scope you set. AI agents then try to exploit what they find and chain weaknesses into attack paths, and every finding is confirmed exploitable before it reaches you. Because tests can run continuously, new exposures are found soon after they appear, and fixes are re-tested on demand.