home/glossary/attack surface

attack surface

nounid 1553·updated May 9, 2026
verified

The set of points on the boundary of a system, a system element, or an environment where an attacker can try to enter, cause an effect on, or extract data from that system, system element, or environment. [19]

MWE

Attested in

NIST SP 800-171 Rev 3 - Protecting CUI in Nonfederal Systems1 citation · 1 machine-matched · observed 2026-09-01 under anchor/0.9/36451/2026-09-01
03.14.08 ¶ 2

Classifications

Entity Type

Vulnerability85%llm-generatedllm:claude-haiku-4-5

Sensitivity

95%llm-generatedllm:claude-haiku-4-5

Information Class

95%llm-generatedllm:claude-haiku-4-5

Variants

plural
attack surfaces
possessive
attack surface's
pluralpossessive
attack surfaces'

Framework definitions

National Initiative for Cybersecurity Careers and Studies (NICCS) Cybersecurity Lexicon1 senseview framework →
§1 · extended_definition_available
The set of ways in which an adversary can enter a system and potentially cause damage.
CPMI-IOSCO Guidance on Cyber Resilience for Financial Market Infrastructures1 senseview framework →
§1
The sum of an information system’s characteristics in the broad categories (software, hardware, network, processes and human) which allows an attacker to probe, enter, attack or maintain a presence in the system and potentially cause damage to an FMI. A smaller attack surface means that the FMI is less exploitable and an attack less likely.
NIST SP 800-172r31 senseview framework →
§1 · glossary
The set of points on the boundary of a system, a system element, or an environment where an attacker can try to enter, cause an effect on, or extract data from that system, system element, or environment. [19]
Attribution from the CKI glossary mapping stage (glossary)
NIST SP 800-171r31 senseview framework →
§1 · attested_usage_pack_match
No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.
Increment 2: attested in 800-171r3 without a glossary definition.
Legacy lexicon import1 senseview framework →
§1 · legacy_primary
The set of ways in which an adversary can enter a system and potentially cause damage.
DR-088 backfill from the noun definition column

Outgoing relationships

No outgoing triples
This term is not the subject of any RDF-style relationship yet.

Incoming relationships

No incoming triples
No other term currently asserts a relationship to this one.