What Is an Attack Surface? Types and Examples

Every system that accepts connections, processes input, grants access, or exposes information gives an attacker something to test. That includes obvious assets such as public websites and VPN gateways, but it can also include cloud APIs, forgotten subdomains, service accounts, SaaS applications, remote administration services, employee devices, and internal systems reachable after an initial compromise.

To answer what is attack surface in cybersecurity, it is the complete set of points an adversary could use to enter a system, influence its operation, maintain access, or extract data. NIST defines an attack surface as the points on the boundary of a system, component, or environment where an attacker can attempt to enter, cause an effect, or extract data.

The important part is that an attack surface is a collection of opportunities. A single vulnerability is not the entire attack surface. The attack surface includes the assets, identities, interfaces, services, connections, and trust relationships that may give an adversary a way into or through an environment.

What is attack surface in cybersecurity?

An attack surface represents the exposure an organization presents to an adversary.

Some parts are intentionally reachable. A customer portal, public API, email gateway, DNS service, or remote-access service must accept traffic to perform its function. Other exposure can appear unintentionally through a misconfiguration, stale account, exposed management interface, forgotten cloud resource, or shadow IT.

Microsoft describes an attack surface as the points where an unauthorized user could attempt to gain access, steal data, or disrupt systems, covering both physical and technology assets.

A useful way to understand what is attack surface is to separate the exposed asset from the weakness affecting it.

Consider a public API. The API belongs to the attack surface because it accepts requests from outside the organization. Broken authorization, an exposed credential, or a vulnerable software component may make that API exploitable.

The API is the exposed point. The security weakness is the condition an attacker may abuse.

That distinction matters because security teams can reduce exposure even when no software vulnerability exists. Closing an unused port, removing an abandoned DNS record, disabling an unnecessary service, or deleting an inactive privileged account removes an opportunity that no longer needs to exist.

The external attack surface

The external attack surface contains assets and services that an adversary can discover or reach from outside the organization's trusted environment.

Common examples include public IP addresses, domains, websites, web applications, APIs, VPN gateways, remote desktop services, email servers, DNS infrastructure, cloud load balancers, public storage endpoints, externally exposed Kubernetes services, and internet-accessible administration interfaces.

Unknown assets deserve particular attention.

A development team may create a temporary cloud service and never remove it. An acquisition may introduce domains and applications that were never added to central asset inventory. An old subdomain may continue pointing to infrastructure that no longer receives normal patching or configuration assessment.

The 2025 Microsoft Digital Defense Report found that 18% of breaches observed by Microsoft Incident Response began through unpatched web assets, while 12% began through exposed remote services. Those findings show why internet-reachable assets need accurate inventory, vulnerability assessment, and timely remediation.

External exposure is not automatically a security defect. Many business services need to be internet accessible. The security question is whether the exposure is intentional, necessary, properly configured, patched, monitored, and owned.

The internal attack surface

Not every useful target needs to be reachable from the internet.

The internal attack surface consists of systems, services, privileges, and communication paths that an attacker may reach after obtaining an initial foothold or valid credentials.

Internal application servers, management interfaces, file shares, databases, administrative protocols, internal APIs, east-west network communication, and poorly segmented workloads can all contribute.

For example, an employee workstation may not contain sensitive production data. If that workstation can authenticate to an administrative server, however, compromising the endpoint may provide the attacker with a route deeper into the environment.

The same principle applies to cloud-native infrastructure. A compromised container may have little value by itself, but broad network access, mounted secrets, or communication with privileged workloads can increase what the attacker can reach next.

Security teams therefore need to consider reachability after initial compromise, not only what can be seen from the public internet.

The identity attack surface

Attackers do not always need a software exploit. Valid credentials can provide direct access.

The identity attack surface includes employee accounts, administrators, service accounts, API keys, access tokens, OAuth applications, workload identities, CI/CD credentials, certificates, and other authentication mechanisms.

Permissions determine the potential impact of compromise.

A service account that can read one application configuration presents a different risk from an account that can create workloads, retrieve secrets, or modify cloud IAM policy.

The 2026 Microsoft Digital Defense Report identifies identity as the primary control plane for defense and notes that attackers continue to take advantage of unnecessary privilege, persistent access, and weak identity governance. The report also stresses that identity protection needs to cover human and non-human identities, including applications and agents.

Reducing identity exposure therefore requires more than password security. Teams need least privilege, strong authentication, credential lifecycle management, permission reviews, and controls over machine identities.

The physical and human attack surface

Cyberattacks can also begin outside software and networks.

The physical attack surface includes laptops, mobile devices, removable media, networking hardware, server facilities, and other equipment an attacker may steal, manipulate, or access directly.

People create another entry point.

Phishing, impersonation, malicious attachments, credential theft, consent phishing, and social engineering attempt to convince authorized users to provide attackers with access.

Microsoft's 2026 threat research reports that people remain a heavily exploited initial-access path, with user execution, phishing, impersonation, and valid account abuse continuing to play major roles in observed intrusions.

Human exposure therefore belongs in attack surface analysis because a successful social engineering attack can provide the identity or device an adversary needs to enter technical systems.

The software and supply chain attack surface

Software can introduce exposure before an application reaches production.

Open-source packages, third-party libraries, build systems, CI/CD platforms, container images, package repositories, software update mechanisms, and vendor integrations can all influence production systems.

A compromised build pipeline may insert malicious code into an otherwise trusted application. A vulnerable dependency may reach many workloads through a shared base image. A stolen publishing credential may allow an attacker to distribute an unauthorized package.

Microsoft's 2026 Digital Defense Report identifies open-source supply chain compromise among the significant emerging threats defenders need to prepare for.

Attack surface analysis therefore needs to consider more than running infrastructure. The systems and dependencies used to build, distribute, update, and administer that infrastructure can provide additional routes to compromise.

Attack surface, attack vector, and attack path are different

These terms describe related but distinct parts of an attack.

The attack surface is the set of opportunities available to an adversary.

An attack vector is the technique or method used to exploit one of those opportunities.

An attack path is the sequence of steps through which an attacker can move from initial access toward a target or objective.

Consider an internet-facing VPN appliance running vulnerable software.

The VPN appliance belongs to the attack surface. Exploiting the software vulnerability is an attack vector. Using the compromised appliance to obtain credentials, access an internal server, and eventually reach a sensitive database forms an attack path.

Keeping those concepts separate improves risk assessment. Security teams can identify exposed assets, determine which attack vectors are practical, and assess which combinations of exposure and privilege create meaningful routes to sensitive resources.

Examples of attack surface exposure

A cloud storage service configured for public access creates exposure because information may become reachable beyond its intended audience.

A public API with weak authorization creates an entry point through which an attacker may access records or functions assigned to another user.

A VPN gateway running a known exploited vulnerability gives an adversary an internet-reachable system with a documented exploitation method.

An employee account that remains active after the employee leaves enlarges the identity exposure even though no software vulnerability is involved.

A development subdomain pointing to an abandoned application creates an externally discoverable asset that may no longer receive normal security maintenance.

An overprivileged Kubernetes service account increases the potential impact of a workload compromise because legitimate permissions may allow access to additional cluster resources.

These examples show why an asset list by itself is insufficient. Security teams also need context about reachability, vulnerabilities, configuration, permissions, ownership, and the resources an attacker could access next.

What is attack surface management?

Attack surface management, or ASM, is the continuous process of discovering assets, identifying exposure, assessing risk, reducing unnecessary access, and monitoring the environment for change.

Microsoft distinguishes attack surface monitoring from the broader management process. Monitoring observes changes and exposures, while management also includes asset discovery, risk assessment, prioritization, and exposure reduction.

Discovery is the starting point because an unknown asset cannot be assessed consistently.

Monitoring then needs to detect changes such as new IP addresses, domains, cloud services, SaaS applications, certificates, remote-access services, and externally reachable interfaces.

Prioritization should focus on practical attackability rather than treating every exposed asset as equally urgent. An internet-facing system with a known exploited vulnerability and privileged connectivity requires different treatment from a static informational website with limited access to internal resources.

What is attack surface reduction?

Attack surface reduction means removing or restricting entry points, privileges, services, and trust relationships that are not required.

That can include decommissioning unused assets, closing unnecessary ports, removing public access, patching exposed systems, disabling legacy protocols, enforcing least privilege, deleting stale accounts, restricting administrative interfaces, segmenting networks, and retiring unsupported software.

The 2026 Microsoft Digital Defense Report recommends reducing exposure before an attack starts through stronger identity controls, restricted privilege, discovery of internet-facing assets, faster remediation of exposed systems, and better awareness of software dependencies.

Reduction does not mean making every system inaccessible. Public services still need to serve customers and partners. The objective is to remove exposure that has no valid operational purpose and apply appropriate controls to the exposure that must remain.

How to determine what is attack surface in your environment

Start with assets and identities rather than vulnerabilities alone.

Security teams need an inventory of public and internal systems, cloud resources, domains, APIs, applications, endpoints, SaaS services, remote-access infrastructure, identities, and software dependencies.

Then establish which of those resources are reachable and from where.

A resource may be publicly reachable, accessible only from an internal network, exposed to a specific partner, or available through an identity with particular privileges.

Next, add security context. Determine whether the asset has known vulnerabilities, unsafe configuration, excessive permissions, unsupported software, weak authentication, or unnecessary connectivity.

Ownership matters as well. An exposed resource with no accountable owner is harder to remediate and easier to overlook.

The resulting view should answer more than "what assets exist?" It should show which assets an adversary can reach, which weaknesses can be exploited, and what those assets connect to.

Attack surfaces change continuously

A one-time inventory becomes outdated quickly.

Cloud resources can be created in minutes. DNS records change. SaaS applications are adopted. Employees join and leave. New APIs are published. Containers are replaced. Third-party integrations receive additional permissions.

The attack surface should therefore be treated as a changing security state rather than a fixed architecture diagram.

Microsoft's 2026 security reporting calls for continuous exposure management that brings asset visibility, vulnerability discovery, threat intelligence, and security analysis together so teams can focus on the risks most likely to matter.

Security teams should be able to identify what changed, whether the change created new exposure or privilege, who owns the affected asset, and whether that access is required.

Attack surface visibility supports better risk decisions

Knowing what is attack surface gives security teams a stronger starting point for vulnerability management, identity security, cloud security, segmentation, and incident response.

The objective is not to produce the largest possible asset inventory. It is to understand which systems, identities, interfaces, and relationships an adversary could use, which opportunities are unnecessary, and which combinations can lead to sensitive resources.

An accurate attack surface view connects assets with exposure, vulnerabilities, permissions, business context, and ownership. That allows teams to remove unnecessary entry points, prioritize reachable weaknesses, and verify that remediation changed the security state of the environment.