The attack surface in plain English
Think of a house. Every door, every window, the basement hatch, and the garage door are potential entry points for burglars. Add to that the spare key under the doormat and the helpful neighbor who lets in anyone posing as a repairman. All of these points together make up the house’s attack surface.
It’s the same in a company – except that many of the “windows” are invisible. An online shop, remote access for working from home, cloud storage, or an old test site forgotten after a project: each of these points can be reached from the outside and is therefore a potential way in.
Important: a large attack surface doesn’t automatically mean you’re vulnerable. It describes where an attack could begin. Whether it succeeds depends on how well each individual point is protected.
What makes up the attack surface
Experts usually distinguish three areas:
- Digital attack surface: everything that can be reached over a network – websites, interfaces between programs (APIs), email servers, VPN access, cloud services, and connected devices such as cameras. The external attack surface can be reached from the internet, the internal one from within the corporate network, for example after an initial break-in.
- Human attack surface: employees whom attackers can contact by email, phone, or social media, for example with phishing – fraudulent messages. Public information such as org charts or job postings counts too, because it makes such deception more convincing.
- Physical attack surface: buildings, server rooms, network jacks in the meeting room, laptops, and USB ports.
The attack surface changes constantly. Every new application, every service provider with remote access, and every additional user account expands it. Shadow IT is particularly tricky: systems that departments set up without IT’s knowledge, such as a cloud storage account for quickly exchanging files with a customer.
Attackers, by the way, start by getting an overview of your attack surface. They analyze freely accessible sources – experts call this OSINT – and run automated scans that constantly search the internet for reachable services.
A practical example
A logistics company introduced a customer portal a few years ago. The agency it hired set up a test environment for it on a separate subdomain – a sub-address of the company website that begins with “test.” After go-live, the environment was forgotten. But it kept running, with outdated software and real customer data from the test phase.
During an OSINT assessment, the subdomain turns up in public certificate logs. These logs record publicly trusted website certificates – and with them the addresses they were issued for. Attackers analyze these logs, too. The company shuts down the test environment, deletes the data, and keeps a list of all externally reachable systems, which it reviews regularly.
Why does this matter for businesses?
You can’t protect what you don’t know about. Attacks often don’t begin at the well-secured main system but at a forgotten side entrance: an old server, an orphaned user account, or remote access without a second sign-in factor.
Every additional system needs updates, secure settings, and monitoring. Where that doesn’t happen, gaps appear. That’s why frameworks such as NIS2 and ISO/IEC 27001 call for companies to manage their assets and handle risks systematically. An up-to-date overview of your own attack surface is the foundation for this.
How to protect your organization
- Keep an inventory: Record all systems, domains, cloud services, and access points – including those that service providers operate on your behalf.
- Switch off what you don’t need: Consistently remove test environments, old servers, unused services, and orphaned user accounts.
- Harden systems: Whatever has to stay is configured on the principle of “as little as possible” – learn more under system hardening.
- Secure access: Protect remote access, cloud accounts, and administration with multi-factor authentication – a second sign-in factor in addition to the password.
- Check regularly from the outside: Automated vulnerability scans and penetration tests show what is reachable and vulnerable.
- Control public information: Check which details about your technology and staff appear in job postings, on your website, and on social media.
- Require approval: New systems and service provider access go live only once IT has approved them.
How Rootsektor can help
With an OSINT assessment, we show you the picture an attacker can piece together about your company from public sources – from forgotten subdomains to exposed information about your employees. A penetration test then clarifies whether the systems found can actually be attacked. You can request a fixed-price quote after scoping via our Pentest Quote page.