Attack surface
external attack surface · internet exposure · exposed perimeter · EASM · surface d’attaque
All the points through which an attacker can try to get into your information systems or extract data from them: internet-facing services, applications, accounts, devices, suppliers and people.
In practice
Every new subdomain, SaaS tool, VPN account or supplier login widens the attack surface, often without anyone noticing. Attackers always start by mapping it from public information: DNS records, certificates, search engines for connected devices. Shrinking and monitoring it is one of the most cost-effective things you can do, because what is not exposed cannot be attacked remotely.
In its 2025 Cyber Threat Overview, ANSSI stresses that edge devices (firewalls, VPN gateways, remote access services) remain priority targets: visible from the internet by design, they become the way in whenever a flaw is not patched in time.
How to protect yourself
- Inventory everything exposed to the internet: domains, subdomains, IP addresses, services.
- Take administration interfaces off the internet, or put them behind a VPN or Zero Trust access.
- Remove unused services, accounts and test sites.
- Continuously monitor new exposures and the certificates issued for your domains.
