Attack Surface and Risk

A burglar casing a neighborhood does not start by picking a lock. They start by counting doors and windows: which ones are unlocked, which houses look empty, which yards have no fence. Attackers do exactly the same to your digital city — except their casing is automated, runs 24/7, and covers the entire internet. Every exposed login page, every employee inbox, every forgotten test server is a door, and the sum of all those doors is your attack surface.

This is why the question "are we a target?" is the wrong question. Automated scanners do not check your company size or your revenue before knocking. The right question is: how many doors do we have, and which ones are weakest?

Risk gives you a way to rank those doors. Risk combines two things: how likely it is that a threat exploits a weakness, and how much impact a success would have. A trivially exploitable flaw on the server holding all customer data is a five-alarm risk. The same flaw on an isolated lab machine with nothing on it barely registers. Defenders never have unlimited time or money, so risk is how you decide where to spend both.

Two habits follow from this lesson. First: shrink the surface — decommission what you do not use, close what does not need to be open. The cheapest door to defend is one that no longer exists. Second: rank by risk, not by noise — the loudest alert is not always the one pointed at your most valuable house.