Attack Surface is the set of points where an attacker could try to enter, affect, observe, or extract data from a system or organization.
Attack Surface gives security, IT, compliance, and business teams a shared term for discussing protection, accountability, and operational risk.