Attack surface is defined as what?

• A. The total number of systems, users, integrations, and configurations that attackers can exploit
• B. The number of legitimate users
• C. The total budget for security tools
• D. The number of firewall rules

Answer: (A)

Attack surface is the total set of entry points and weaknesses through which an attacker could gain unauthorized access or cause harm. It includes all systems, users, integrations, and configurations that could be exploited, such as exposed services, APIs, misconfigurations, unpatched software, and third-party connections. The broader the surface, the more paths an attacker might probe.

This definition emphasizes exposure rather than resources or controls. It isn’t about how many legitimate users exist, nor about the security budget, nor about the number of firewall rules. Those are separate concepts; the attack surface focuses on potential access points that could be exploited and thus what needs hardening.