What is an attack surface and how can you reduce it?

Every organisation has systems, accounts, applications and connections that make day-to-day business possible. Each can also represent a potential opportunity for a threat actor. Together, these potential entry points form an organisation’s attack surface.

As businesses adopt cloud services, web applications, remote working, mobile devices and third-party platforms, that attack surface becomes increasingly distributed. It may span the corporate network, cloud infrastructure, employee identities, external suppliers and physical locations.

Understanding that exposure is an important part of cyber security. You cannot protect an asset you do not know exists, and you cannot effectively manage security risks without understanding the routes malicious actors might use to gain unauthorised access.

The objective is not to eliminate every possible entry point. Modern organisations need connected technology to operate. Instead, attack surface reduction is about removing unnecessary exposure, strengthening the access points that need to remain and making it harder for an attacker to progress if an initial compromise occurs.

If you are reading this because your organisation has experienced a cyber incident and is unsure how to respond, contact Zensec immediately.

What is an attack surface?

An attack surface is the collection of systems, accounts, applications, devices, services and other potential entry points that an attacker could attempt to exploit to gain access to an organisation’s systems or sensitive data.

An attack surface can include:

• internet-facing web applications and web servers
• employee devices and accounts
• cloud services and infrastructure
• email and authentication systems
• remote access services
• third-party integrations
• internal systems and network infrastructure
• unnecessarily exposed services
• outdated software
• physical locations and equipment
• people susceptible to social engineering attacks.

It is useful to distinguish between an attack surface and attack vectors. The attack surface describes what is potentially exposed. An attack vector is a method or route an attacker may use to exploit that exposure. For example, a user account is part of the attack surface. A phishing attack designed to steal its credentials is a possible attack vector. An unpatched web application is part of the attack surface; exploitation of a specific vulnerability may provide the attack vector.

Understanding both helps security teams move beyond simply listing assets and vulnerabilities towards identifying realistic attack paths through the environment.

What are the different types of attack surface?

An organisation’s entire attack surface is generally broader than its IT infrastructure. Digital, physical and human components can all create opportunities for compromise. The digital attack surface encompasses the technology an organisation operates or depends on. That includes endpoints, web applications, servers, cloud services, network infrastructure, accounts and externally accessible systems.

The external attack surface is the subset that can be identified or accessed from outside the organisation. This can include websites, web servers, cloud resources, remote access services and other internet-facing infrastructure. External attack surface management is particularly valuable for identifying forgotten or poorly controlled assets that may not appear in an organisation’s central IT inventory.

There is also a physical attack surface. Offices, server rooms, networking equipment and employee devices may provide opportunities for unauthorised physical access if appropriate security measures are not in place.

Finally, there is the human attack surface. People can be targeted using phishing, impersonation and other forms of social engineering. Weak passwords, inappropriate access permissions or unsafe authentication processes can add to that exposure.

These different areas are interconnected. A successful social engineering attack may compromise an account, which creates access to an application, which in turn provides a route towards valuable data or other internal systems. That is why effective attack surface analysis needs to consider more than individual vulnerabilities in isolation.

Why are modern attack surfaces growing?

Traditional security models often concentrated heavily on the corporate network. Important applications and data were located within a relatively defined perimeter and access from outside could be tightly controlled.

Today’s IT environment is different. Organisations increasingly operate across SaaS applications, public cloud infrastructure, mobile devices, remote endpoints and interconnected supplier platforms. Employees may access company data without ever being physically connected to the enterprise network.

Technology also changes quickly. Development teams can provision new infrastructure and applications in minutes. Third-party vendors may be granted access for specific projects. Employees move between roles and acquire different access permissions. Legacy services can remain online even when their original business purpose has disappeared. The difficulty is therefore both visibility and control.

Asset discovery is an essential part of attack surface management because security professionals first need to establish what exists, where it is located, who owns it and whether it is exposed. Without reliable asset discovery, the IT team can secure everything it knows about and still leave unknown assets accessible to threat actors.

What is attack surface management?

Attack surface management is the ongoing process of discovering, assessing, prioritising and managing exposures that could be targeted in a cyber attack. The word ongoing matters.

A security assessment provides a view of an organisation’s security posture at a particular point in time. The underlying environment may then change as new applications, users, suppliers and infrastructure are introduced. Effective attack surface management therefore combines asset discovery with continuous monitoring, vulnerability management, secure configuration, security testing and risk management.

It also helps organisations prioritise. For example, a security vulnerability affecting an isolated internal system may present a very different risk from a vulnerability affecting an internet-facing application that provides access to confidential data.

Attack surface analysis should therefore examine the context around an exposure. Security teams need to understand not only whether a vulnerability exists, but what an attacker could potentially reach by exploiting it.

What is attack surface reduction?

Attack surface reduction is the process of removing unnecessary potential entry points and making necessary ones more difficult to exploit. One of the most effective questions is also one of the simplest: does this need to be accessible at all?

Consider an old application exposed to the internet. An organisation could repeatedly scan, patch and monitor it. But if nobody needs it, securely decommissioning the application removes that entry point from the attack surface entirely.

The same principle applies elsewhere. Removing unnecessary software, closing unused network services, disabling dormant user accounts, restricting unnecessary access permissions and retiring obsolete infrastructure can all contribute to a smaller attack surface.

Reducing the attack surface does not mean blindly reducing the number of assets. Security teams still need to consider the organisation’s risk profile. One poorly protected privileged account could create substantially more risk than dozens of tightly controlled, low-value systems.

How can organisations reduce their attack surface?

There is no single security product that can reduce every element of an attack surface. A coordinated approach should address technology, identity, network access and people.

• Know what you have: Maintain an accurate inventory of hardware, software, cloud resources, accounts, applications and external services. Use asset discovery and continuous monitoring to identify new or previously unknown assets.
• Remove unnecessary exposure: Decommission obsolete systems, remove unnecessary software, close unused access points and disable accounts that no longer have a legitimate business purpose.
• Maintain secure configuration and patching: Outdated software can leave known security vulnerabilities available to exploit. Vulnerability management should identify weaknesses and prioritise remediation according to exposure, exploitability and business impact.
• Implement network segmentation: A flat network can make lateral movement easier after an attacker establishes an initial foothold. Organisations can implement network segmentation to separate critical systems and reduce the ability of one compromised account or device to reach the wider enterprise network.
• Monitor and test: Logging, intrusion detection systems, intrusion prevention systems and other monitoring controls can help identify suspicious behaviour. Vulnerability assessment and security testing can then evaluate whether controls are working as expected.

Most importantly, organisations should also consider identity as part of attack surface reduction.

Identity is part of your attack surface too

Attack surface management can easily become focused on devices, software and network infrastructure. But identities and authentication methods are also potential entry points.

Passwords can be guessed, reused, stolen or captured through social engineering. Even where multi-factor authentication is deployed, identity risk can remain if authentication methods are phishable, policies are applied inconsistently or risky authentication flows remain available.

Moving towards phishing-resistant authentication, including passkeys, can therefore form part of reducing the identity attack surface.

But this is where the distinction between adopting a technology and improving security becomes important.

Passkeys strengthen authentication. They do not remove the need to understand which users require access, whether devices are suitable, how access policies are enforced or what should happen during account and device recovery.

The wider identity environment still matters.

That is why access permissions should follow the principle of least privilege, ensuring that only the right people can access the systems and sensitive data necessary for their roles. Privileged identities deserve particular attention because compromising one may provide an attacker with considerably greater access.

How does zero trust help?

A zero trust security model complements attack surface reduction by limiting the trust available to an attacker if an initial entry point is compromised.

Under zero trust, access should not automatically be trusted simply because a user or device is inside the corporate network. Identity, device and access requirements need to be verified according to appropriate security policies. This matters because preventing initial access is only part of cyber security.

Imagine that a threat actor successfully compromises an account. If that account has excessive permissions and can access large parts of the organisation’s network, one compromised identity could become an attack path towards sensitive data and critical applications.

Strong authentication, appropriate access permissions and network segmentation can help restrict that progression. The objective is defence in depth: reduce opportunities for initial compromise, then make it significantly harder for malicious actors to expand their access if they get through.

Remember the third-party attack surface

An organisation’s attack surface can extend beyond systems it directly owns. Third-party vendors may process company data, connect to internal systems or receive privileged access for support. Those relationships can introduce additional security risks if access is excessive, poorly monitored or left in place after it is no longer required.

Risk management should therefore consider what external organisations can access, which authentication methods they use and how those connections are controlled. The same discipline should apply internally. Access that was appropriate when an employee joined a project may no longer be justified after responsibilities change. Regular access reviews help system administrators ensure permissions continue to reflect genuine business requirements.

How should security teams prioritise attack surface risk?

Discovering possible entry points is only useful if organisations can determine which exposures matter most.

When reviewing an attack surface, useful questions include:

• Is the asset externally accessible?
• Does it contain or provide access to valuable or sensitive data?
• Are known security vulnerabilities present?
• What privileges could an attacker obtain?
• Could the asset provide an attack path to other systems?
• Could compromise enable lateral movement?
• What authentication and access controls protect it?
• Would intrusion detection or prevention systems identify suspicious activity?
• How quickly could the organisation respond?

This context helps security teams focus remediation on exposures that genuinely affect the organisation’s security posture rather than treating every technical finding as equally urgent.

Reducing attack surface means reducing opportunity

Attack surface reduction is ultimately about reducing the number and usefulness of opportunities available to an attacker. That means maintaining visibility of the IT environment, removing unnecessary systems and software, addressing vulnerabilities, implementing network segmentation, strengthening authentication and limiting access permissions. It also means continuously monitoring for change because today’s controlled environment can become tomorrow’s exposure.

Identity deserves particular attention.

Passwords and phishable authentication methods can provide an entry point into otherwise well-defended environments. Moving towards passkeys and other phishing-resistant methods can reduce exposure to some credential-based attack vectors, but authentication cannot be considered in isolation.

Access policies, users, devices, recovery processes and operational ownership all influence the resulting security posture. If passkeys are on your roadmap, start by understanding whether the rest of your identity environment is ready too.

Download Zensec’s seven-question Identity Security Readiness checklist to assess your users, devices, authentication methods, policies, recovery and rollout before deploying passkeys.