The attack surface is the sum of every point where an unauthorized party could try to get into a system or pull data out of it. That includes open ports, running services, exposed APIs, user input fields, and any other path reachable from outside the security boundary. The larger and more varied it is, the more chances an attacker has to find one weak spot.
Shrinking the attack surface is one of the highest-value moves in security precisely because it is preventive rather than reactive. Every service you disable, port you close, and unused account you remove is one fewer thing to patch, monitor, and defend. Cloud environments make this harder than it sounds, because a single misconfigured storage bucket or a forgotten test instance can widen the surface overnight without anyone deploying new code. Continuous discovery matters as much as the initial hardening, since the surface grows every time someone spins up a new resource.
How is attack surface tested on the CISSP?
Attack surface management maps to Domain 3: Security Architecture and Engineering and connects to risk management. Candidates should be able to explain how architecture choices expand or reduce it. CISA offers practical guidance on attack surface management.
Related terms: Vulnerability, Threat Modeling