Attack surface
An attack surface is the set of points where an attacker could interact with a system or environment to gain entry, affect its operation, or extract information.
The places an attacker can interact with
An application’s login page, a public API, and a help desk’s recovery form are different kinds of entry point. What belongs in the attack surface depends on the system or environment you are reviewing. NIST’s definition includes points where someone could enter, affect operation, or extract information.
A help-desk review might cover phone intake, web requests, and the administrative handoff to the identity system. Looking only at the public form would miss the decisions and permissions behind it.
Surface, weakness, and path
These terms answer different questions:
- Attack surface: Where could someone interact with the environment?
- Vulnerability: What weakness could they exploit?
- Attack path: How could particular actions and conditions connect to an objective?
A phone line remains part of the surface even when staff reject an impersonator’s request. Its existence does not establish a weakness or prove account access.
Attack surface management keeps that inventory current and helps reduce unnecessary exposure. Attack-path analysis looks at how the remaining points could connect. Both need a clear boundary: one application, a business workflow, or the wider organization.