Home / Knowledge hub / Attack surface
Knowledge hub
Attack surface
Everything about your application an outsider can touch.
What it means
Your attack surface is everything about your application an outsider can touch. Every page. Every API endpoint. Every upload box and login form. Every forgotten staging copy still sitting on the internet.
The number does not measure how bad your security is. It counts how many places something could go wrong, which is a different and more useful thing to know.
Why it matters
It grows quietly. A feature adds endpoints. A partner integration adds a webhook. A rebuild leaves the old version running because nobody was sure who still used it. Last year's list is never this year's list.
Size is not really the problem. The gap between what exists and what you know exists is, because nobody tests, patches or watches a thing they have forgotten. An old admin panel gets no attention from you and full attention from anyone scanning the internet.
There is a quick test for whether your list is current. Ask two engineers to write down every endpoint a customer can reach. The difference between their lists is the part nobody is watching.
How it shows up
Start with what you ship. The endpoints your website calls, and the ones only the mobile app calls. Admin panels. Upload paths. Anything that accepts a redirect target. Every environment reachable without a password.
The entries people miss are usually old. A demo instance. An API version you meant to retire. A debug route left on after an incident two years ago.
Write the list down and put a date on it. An undated list quietly turns into last year's list without anyone noticing.
Questions people ask
Attack surface, answered
What is the difference between an attack surface and an attack vector?
Your attack surface is the set of places somebody could try. An attack vector is one route they actually take. The surface is the map. A vector is the road.
The distinction matters when you are buying. Counting surface tells you how much there is to look after. Testing vectors tells you which parts currently give way.
Our marketing site is only static pages. Does it still count?
Yes, though it is a smaller amount. Static pages still carry a domain name, a host, a delivery network and whatever scripts you load from other companies. Each of those is somebody else's code running under your name.
The bigger risk usually sits next door. A static site on the same domain as the product can reach the product's cookies, so the two surfaces are less separate than the tidy diagram suggests.
Does adding security features make the attack surface bigger?
Sometimes it does, and it is a fair question to ask. A second factor adds an enrolment flow, a recovery flow and a device list. Each of those is new code that somebody can poke at.
The trade is almost always worth taking. Just test the new flows rather than assuming that a control added for safety arrived safe.
How do we find the subdomains and old sites we have forgotten?
Start with two lists you already own: your DNS records and your hosting bill. Between them they name most of what exists. Then ask whoever runs the domain to export everything pointing at it.
Watch for names that still point at a service you stopped paying for. Somebody else can often claim that service and start serving pages from your address.
Does removing old features actually reduce our risk?
Usually yes, and it is the cheapest security work available. Code that no longer exists needs no patching, no testing and no watching.
Retire the endpoint properly though. Removing the button while the route still answers leaves the surface exactly where it was, and takes away your last reminder that it is there.
Related
Terms that sit next to this one
API
The part of your application other software talks to, not a person.
Unauthenticated access
Anything your application answers without signing in at all.
Enumeration
Working out what exists by asking repeatedly and watching the answers.
Penetration test
A time-boxed engagement where skilled people attack your systems by hand.
Vulnerability management
The loop of finding, prioritising, fixing and checking the fix held.
Do you know what you expose?
Point us at one application and we work through what it reaches: endpoints, admin routes, upload paths, anything open without a login. You get evidence, not a list of maybes.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.