Attack surface is every point where a bad actor could try to get into your systems—every device, account, application, and connection an attacker could probe, exploit, or abuse. It includes the assets you know about, plus the shadow IT and forgotten accounts nobody’s tracking.
Key takeaways
- Your attack surface is every possible entry point a cybercriminal could use (devices, accounts, apps, cloud workloads, and network connections), known or not.
- Attack surface and attack vector aren’t the same thing. Surface is everywhere an attacker could get in. Vector is the specific path they use.
- It breaks into seven categories: cloud, email, endpoint, identity, network, SaaS, and AI—and they constantly overlap, so defending them one at a time leaves gaps.
- AI is the newest addition to the attack surface, and most security teams haven’t fully mapped it yet.
- Reducing your attack surface takes ongoing inventory, cleanup, and monitoring, not just a one-time audit.
Attack surface is one of the most-used terms in cybersecurity, and also one of the most loosely applied. It gets stretched to cover everything from a single exposed server to an entire security program. This page cuts through that: what an attack surface actually is, how it’s different from an attack vector, the six categories that make it up, and the practical steps that shrink it. We’ll also cover where managed detection and response (MDR) fits once you’ve mapped what you’re defending, because knowing your attack surface only matters if something’s watching it.
What is an attack surface?
Your attack surface is every possible entry point a cybercriminal could use to get into your environment. That includes every device, account, application, cloud workload, and network connection tied to your organization, whether IT knows about it or not.
Every asset you own, connect, or expose to the internet adds to it. So does every asset you forgot about: the test server nobody decommissioned, the marketing intern’s SaaS trial account, the vendor integration from three years ago. Attack surface isn’t static. It grows every time someone spins up a new service, and it’s usually bigger than most security teams think it is.
Attack surface is also different from risk. A large attack surface isn’t automatically dangerous if it’s well monitored. An unmonitored one—even a small one—is exactly where cybercriminals look first, because it’s the path of least resistance.
What’s the difference between attack surface and attack vector?
An attack surface is everywhere a cybercriminal could get in. An attack vector is the specific path they actually use to do it.
Think of your attack surface as the full set of doors and windows on a building. An attack vector is the one door somebody actually walks through—say, a phished credential, an unpatched vulnerability, or a misconfigured cloud bucket left open to the internet.
You map your attack surface once (then keep it updated). You investigate attack vectors after (or ideally before) an incident, to understand exactly how an intrusion happened or could happen. Security teams that only think in vectors tend to fix one hole at a time, but teams that think in attack surface fix the pattern.
What are the seven types of attack surface in cybersecurity?
Most organizations’ attack surface breaks down into six established categories, plus AI as the newest addition. They overlap constantly, which is part of what makes them hard to defend independently.
| Attack surface | What it includes | Common risk |
|---|---|---|
|
Cloud |
IaaS, PaaS, containers, storage buckets | Misconfigurations, exposed storage |
|
|
Inboxes, mail gateways, collaboration tools | Phishing, business email compromise (BEC) |
|
Endpoint |
Laptops, servers, mobile devices, IoT | Malware, unpatched software |
|
Identity |
User accounts, credentials, service accounts | Credential theft, privilege escalation |
|
Network |
On-prem infrastructure, VPNs, remote access | Lateral movement, unpatched perimeter devices |
|
SaaS |
Third-party apps, browser-based tool | Shadow IT, over-permissioned integrations |
|
AI |
Models, agents, AI-powered tools, training data | Prompt injection, agent misuse, data exposure |
No category sits in isolation. A compromised identity can open up your cloud environment. A phishing email can land on an endpoint and pivot to your network. Treating these as six separate problems is how gaps happen.
What about the human attack surface?
You’ll sometimes see “human attack surface” used as a catch-all term for people-targeted risk—susceptibility to social engineering, weak security habits, insider mistakes. It’s a real risk, but it isn’t a seventh category alongside the six above.
That’s because human-targeted risk doesn’t have its own infrastructure to defend. It shows up as an outcome inside the categories you already have. A phishing attempt is an email risk until someone clicks it, at which point it becomes an identity risk (stolen credentials) or an endpoint risk (malware on a device). A social engineering call to your help desk is an identity risk. There’s no separate “human” system to monitor the way there’s a cloud account or a network segment to monitor.
Industry frameworks treat it the same way. MITRE ATT&CK doesn’t have a “human” tactic—phishing sits under initial access, credential misuse sits under identity-related techniques. So when you’re mapping your attack surface, don’t look for a human column. Look for how human error and manipulation feed into the email, identity, and endpoint categories you’re already tracking.
How does Expel map attack surface coverage?
Most vendors talk about attack surface coverage in the abstract. We map it against the same six categories above, and we’re specific about it: what’s covered, what’s excluded, and where the gaps sit before we ever start monitoring.
That means mapping identity coverage down to which identity providers and privileged accounts are watched, not just “identity” as a checkbox. It means knowing which cloud accounts and workloads have telemetry flowing in versus which are blind spots. It means treating SaaS the way it actually behaves in most environments; sprawling, unofficial, and often set up by a team that never looped in security.
We built it this way because a coverage map that isn’t specific isn’t really a map—it’s a sales slide. When you know exactly where your telemetry is thin, you know exactly where to prioritize next.
Is AI part of the attack surface now?
Yes. AI tools, models, and agents are the newest addition to the attack surface, and they don’t fit neatly into the six traditional categories.
An AI copilot with access to your codebase is an identity risk and an endpoint risk. An agentic AI tool that can take autonomous action across your systems is a new kind of access point entirely, and it’s one most security teams haven’t fully mapped yet. It breaks down into three fronts: attackers using AI to accelerate intrusions, employees feeding data into public models, and the AI systems your own teams are building. This deserves its own deep dive, which is why we cover it separately on our AI attack surface coverage page.
What is attack surface management (ASM)?
Attack surface management (ASM) is the ongoing process of discovering, tracking, and reducing every asset in your attack surface, including the ones you didn’t know you had.
ASM isn’t a one-time audit. It’s continuous, because your attack surface changes every time someone provisions a new cloud instance, connects a new SaaS tool, or creates a new account. Good ASM programs answer three questions on a rolling basis:
- What do we have?
- What’s exposed?
- What’s changed since last week?
What is cyber asset attack surface management (CAASM)?
Cyber asset attack surface management (CAASM) is a category of tools built to give security teams a single, consolidated inventory of every asset by pulling data from existing tools instead of deploying new agents.
Where traditional ASM often leans on external scanning to find internet-facing assets, CAASM aggregates what you already have: your CMDB, your cloud provider APIs, your identity provider, your endpoint agents. The goal is one accurate asset inventory instead of six disconnected spreadsheets.
How do you reduce your attack surface?
You can’t eliminate your attack surface. The goal is shrinking it and watching what’s left. Five steps that consistently move the needle are:
- Inventory everything. You can’t reduce what you haven’t found. Start with a full asset discovery across cloud, SaaS, identity, and endpoints.
- Kill what you don’t need. Decommission unused accounts, retired servers, and SaaS trials nobody remembers signing up for.
- Fix misconfigurations first. Open storage buckets and over-permissioned accounts are usually easier to fix than they are to find.
- Enforce least privilege. Every account and integration should have only the access it needs, not the access it was given by default.
- Monitor what’s left continuously. A smaller attack surface still needs eyes on it—reducing exposure doesn’t replace detection.
What should you look for in attack surface management tools?
Look for continuous discovery, not point-in-time scans. Your attack surface changes daily, and a tool that only refreshes monthly is already out of date by the time you act on it.
Prioritize tools that map findings to the seven categories above rather than dumping an undifferentiated asset list. Check whether the tool tells you what’s actually exploitable versus what’s just present. A long list of “vulnerabilities” with no risk context just creates alert fatigue. And ask how findings get acted on. A tool that finds exposure without a path to response just adds noise.
The best attack surface management tools pair discovery with response, not just visibility.
Frequently asked questions
What is an attack surface in simple terms?
An attack surface is every possible way a cybercriminal could get into your systems. That includes your devices, accounts, applications, cloud services, and network connections; the ones IT knows about and the ones it doesn’t. The bigger and less visible your attack surface, the more places a bad actor has to try their luck.
What’s the difference between attack surface and attack vector?
Your attack surface is everywhere an attacker could get in, and an attack vector is the specific path they actually used. Attack surface is the full set of doors and windows in your environment. An attack vector—a phished credential, an unpatched vulnerability, a misconfigured cloud bucket—is the one door somebody walked through.
What’s included in an organization’s attack surface?
An organization’s attack surface spans seven categories: cloud, email, endpoint, identity, network, SaaS, and AI. Each category includes both the assets security teams know about and the shadow assets they don’t, like unofficial SaaS trials or forgotten test servers.
Is AI part of the attack surface now?
Yes, AI tools and agents are the newest addition to the attack surface. AI copilots with access to code or data create identity and endpoint risk, and agentic AI tools that can take autonomous action introduce an entirely new kind of access point. See Expel’s AI attack surface coverage for how that breaks down across attacker AI, employee misuse, and customer-built AI systems.
How do I start reducing my attack surface?
Start with a full asset inventory, because you can’t reduce what you haven’t found. From there, decommission what you don’t need, fix misconfigurations, enforce least privilege, and keep monitoring whatever’s left.