Attack Surface

The attack surface is the sum of all points where an attacker could attempt to enter or extract data from an application or system. It encompasses exposed APIs, open ports, user input fields, authentication endpoints, and third-party integrations.

Reducing the attack surface — by disabling unused features, minimizing exposed interfaces, and applying least privilege — is a core security engineering principle.