An attack surface is a conceptual "area" of use and activity where security vulnerabilities may exist, and which therefore becomes a target for cybersecurity attacks.

Common attack surfaces include networks, consoles, login prompts, integration endpoints, support teams and call centers, or any other avenues through which an attacker may plausibly seek vulnerabilities that can be exploited in order to gain illicit access to an organization's systems, data, or resources.

Security-minded organizations common seek to reduce their overall "attack surface area" in order to lower the probability that an attacker will be able to find and exploit a vulnerability in order to achieve such access.