### What is an attack surface?

An attack surface is defined as the total number of all possible entry points for unauthorized access into any system. It includes all vulnerabilities and endpoints that can be exploited to carry out a security attack. The attack surface is also the entire area of an organization or system that is susceptible to hacking.

For most modern businesses, the attack surface is complex and massive. The large number of devices, web applications and network nodes create many potential cybersecurity threats.

IT leaders, despite their best efforts, can only see a subset of the security risks faced by their organization.

### What are the different types of attack surfaces?

Attack surfaces can be physical or digital:

- Digital attack surfaces encompass applications, code, ports, servers and websites, as well as unauthorized system access points. Vulnerabilities left by poor coding, weak passwords, default operating system settings, exposed application programming interfaces or poorly maintained software are all part of the digital attack surface.
- Physical attack surfaces comprise all endpoint devices, such as desktop systems, laptops, mobile devices and USB ports. Improperly discarded hardware that may contain user data and login credentials, passwords on paper or physical break-ins are also included.

Both physical and digital attack surfaces should be limited in size to protect surfaces from anonymous, public access.