To effectively defend against attacks, cybersecurity professionals must understand both the attack surface and the threat vectors available to adversaries. These concepts help describe how and where systems are vulnerable.
Some threat actors take advantage of the vast exposed area a company or user might have over the internet. Others may get access to your wi-fi simply because they live close to you. These are both known as different attack surfaces. The attack surface refers to the sum of all potential entry points an attacker could exploit in a system. This includes:
-
Physical components (e.g., USB ports or unsecured server rooms)
-
Digital interfaces (e.g., web applications, APIs, exposed services)
-
Human users (e.g., employees susceptible to social engineering)
A large or poorly managed attack surface increases the number of opportunities an attacker has. Minimizing this surface (by disabling unused services, closing unnecessary ports, and limiting user permissions) is a key principle in security hardening.
Threat vectors, on the other hand, are the specific paths or methods that attackers use to exploit vulnerabilities and gain access. As such, your shady neighbour that covertly gets access to your wi-fi might use a deauthentication attack. Common threat vectors include:
-
Phishing emails that lure users into clicking malicious links
-
Drive-by downloads from compromised websites
-
Social engineering phone calls impersonating IT support
-
Vulnerable remote access tools, like unpatched VPN clients
Understanding the difference between the overall surface and the specific vectors allows organizations to implement targeted defenses. For instance, reducing the attack surface might involve removing legacy protocols like Telnet, while defending against vectors might include deploying email filtering and web protection gateways.