Definition
Plain language
All the ways someone could try to break into a piece of software.
As stated in the literature
The set of entry points — inputs, interfaces, network endpoints, parsers, privileged operations — through which an attacker can interact with a system; reducing it is a core hardening goal.
Also called: attack surfaces
Why it matters: Every extra input or interface is another door someone has to guard, so shrinking the attack surface is usually the cheapest way to reduce risk.
For example, a web app that also accepts file uploads, exposes an admin login page, and runs a public API has a much larger attack surface than one that only serves static pages.
Heard on the show
“… That's expensive enough that running slyp at scale across the full Windows attack surface has nontrivial economics, and the paper doesn't compare those token costs against the cost of …”Episode 024 — An AI Agent That Found 28 Zero-Days in Windows — And What Made It Work