Attack surface and attack vectors: how breaches start
In short: The attack surface is every point where an attacker could try to get in. An attack vector is the route actually used, such as phishing or an exposed remote access service. Shrinking the surface and closing common vectors prevents most breaches.
Surface and vector
Your attack surface is the total of all the places an attacker could try to interact with or misuse: internet-facing servers, user accounts, cloud storage, staff inboxes, Wi-Fi networks, even the reception desk. An attack vector is the specific path used in an attack, for example a malicious email attachment or a password-guessing attack against a VPN login.
A useful way to think about it: the surface is the number of doors and windows in a building; the vector is the one the burglar actually used.
Common attack vectors
| Vector | How it works | Main defence |
|---|---|---|
| Phishing | Tricks a user into clicking, opening a file or entering a password | Email filtering, MFA, awareness |
| Exploiting public services | Attacks a known flaw in a VPN, firewall or web app | Fast patching, reducing exposure |
| Stolen or weak credentials | Logs in with leaked or guessed passwords | MFA, password checks, monitoring |
| Exposed remote access | RDP or SSH open to the internet | VPN or zero trust access, no direct exposure |
| Misconfigured cloud | Public storage buckets, open admin consoles | Posture management, secure defaults |
| Supply chain | Compromise of a supplier, update or library | Vendor assessment, least privilege for suppliers |
| Removable media and physical | Infected USB drives, tailgating into offices | Device control, visitor procedures |
Why surfaces grow
Organisations rarely mean to expand their exposure. It happens through ordinary change: a test server left online after a project, a marketing team signing up for a new SaaS tool without telling IT (shadow IT), a firewall rule opened "temporarily" years ago, or remote workers connecting from home networks. Mergers and new suppliers add more. If you do not have an accurate inventory, you cannot protect what you do not know exists.
Reducing your exposure
- Inventory everything. Keep a list of hardware, software, cloud accounts, domains and public IP addresses.
- Check from the outside. Review what the internet can see: open ports, login pages, certificates and DNS records. Scan only ranges you own or have written permission to test.
- Remove what is not needed. Shut down unused services, delete old accounts and close forgotten firewall rules.
- Harden what stays. Patch, apply secure configuration baselines and require MFA on every remote login.
- Put services behind controls. Admin interfaces should only be reachable over a VPN or a zero trust access gateway.
- Monitor for change. Alert when new public services or cloud resources appear.
Tip: a common exam and interview question is "how would you reduce the attack surface of a server?" Good answers include removing unused software and services, closing ports, applying least privilege, patching and enabling logging.
Practice
What is the difference between an attack surface and an attack vector?
Give two examples of shadow IT and why they increase risk.
A company has RDP open to the internet on a server. Suggest two ways to reduce this exposure.
Key takeaways
- The attack surface is every point an attacker could try to use.
- An attack vector is the route actually used, such as phishing or an unpatched service.
- Surfaces grow through shadow IT, forgotten servers and temporary rules.
- Inventory, remove, harden, gate and monitor to shrink exposure.
- Most initial access comes from phishing, stolen credentials and unpatched public services.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.