What makes up an attack surface

Security teams usually split the attack surface into three overlapping parts.

  • Digital attack surface. Everything reachable over a network: domains and subdomains, IP addresses, open ports, web applications, APIs, VPN gateways, email servers, cloud storage and SaaS accounts.
  • Human attack surface. Employees, contractors and executives who can be phished, impersonated or whose credentials can leak. Personal information published online widens this part.
  • Physical attack surface. Offices, devices and hardware that someone could access in person.

The external attack surface is the portion visible from the public internet without any access. It is usually where attacks begin, which is why it gets particular attention.

Why the attack surface keeps growing

Cloud adoption, remote working, SaaS sprawl and faster software delivery all add new internet-facing assets. Each new subdomain, test environment or forgotten integration adds a possible entry point. Mergers bring in whole estates that were managed to a different standard. At the same time old assets are rarely switched off, so the attack surface tends to grow rather than shrink unless it is actively managed.

How to reduce your attack surface

  1. Build and maintain an accurate inventory of what you expose, including assets created outside central IT.
  2. Decommission what is no longer needed, including old DNS records that point at retired services.
  3. Close unnecessary ports and put admin interfaces behind a VPN or zero trust access.
  4. Patch internet-facing software first, prioritising vulnerabilities that are being actively exploited.
  5. Monitor continuously, because the attack surface changes every week.

Example

A firm's main website is well protected, but a search of certificate transparency logs reveals vpn-old.example.com, a legacy VPN appliance that was replaced but never switched off. It still accepts logins and runs firmware with a known authentication bypass. That single forgotten asset is part of the attack surface, and it is often the one attackers use.

How DarkInvader helps

DarkInvader maps your external attack surface automatically, then keeps it current. It finds assets you did not know about, shows how they connect, and flags exposed services, vulnerable software and leaked data linked to your organisation.

Explore Asset Discovery

Frequently asked questions

What is the difference between an attack surface and an attack vector?

The attack surface is everything an attacker could target. An attack vector is the specific method used to exploit one part of it, such as phishing, a vulnerable web application or stolen credentials.

What is an external attack surface?

It is the part of the attack surface that can be reached from the public internet without any access, such as websites, subdomains, exposed services, cloud storage and login portals.

How do you measure an attack surface?

Start with an inventory of internet-facing assets and track how many there are, how many have exposed services or known vulnerabilities, and how quickly new exposures are fixed. The trend over time matters more than any single number.

Related terms and reading

Sources