Security Glossary

Definition

What is Attack Surface?

The sum of all potential entry points where an unauthorized user could attempt to enter, extract data from, or disrupt a system, including exposed network ports, APIs, web interfaces, authentication endpoints, third-party integrations, and human-facing channels such as email. Minimizing the attack surface by disabling unused features, enforcing least-privilege access, and removing unnecessary dependencies is a foundational security hardening principle.

Related terms

Threat Modeling →
A structured process for systematically identifying, prioritizing, and planning mitigations for potential security threats to a system, ideally conducted during the design phase before code is written.
Vulnerability Assessment →
A systematic process of identifying, classifying, and prioritizing security weaknesses in a system without attempting to exploit them.
Security Misconfiguration →
The most prevalent web application vulnerability class, arising from incorrectly configured cloud services, application frameworks, databases, web servers, or network infrastructure.
Penetration Testing →
A structured, authorized simulation of a real-world cyberattack against a system, network, or application with the goal of identifying exploitable vulnerabilities before malicious actors do.