Attack surface
An attack surface is every point where an attacker could try to get into your organisation: each internet-facing service, device, account and piece of software. Cyber Essentials v3.3 shrinks it by blocking unauthenticated inbound connections (A4.7), removing unused software, services and accounts (A5.1, A5.2), and removing unsupported software (A6.6).
- Term
- Attack surface
- Also known as
- Attack surface reduction
- Category
- Malware, cloud and threats
- Requirement area
- Scheme vocabulary
- Reviewed against
- Requirements v3.3
What does the term attack surface mean in Cyber Essentials?
An attack surface is every point where an attacker could try to get into your organisation: each internet-facing service, device, account and piece of software.
How does attack surface apply to Cyber Essentials?
In plain terms
Think of a building. Every door, window, skylight and letterbox is a way in. The more there are, the more a burglar can try, and the more you have to lock and check. In IT the openings are internet-facing services, unused accounts, old software and devices nobody remembers. Reducing the attack surface means bricking up the openings you do not need.
What Cyber Essentials asks
The requirements do not use the phrase, but several controls exist to shrink it:
- Firewalls. "By restricting access to these services, you reduce your exposure to attacks." Unauthenticated inbound connections are blocked by default (A4.7), and rules that are no longer needed are removed. A4.6 asks whether you have reviewed your firewall rules in the last 12 months.
- Secure configuration. Its aim includes making sure devices "provide only the services required to fulfil their role". You must "remove or disable unnecessary software (including applications, system utilities and network services)" (A5.1) and unnecessary user accounts (A5.2).
- Security update management. Unsupported software must be removed, or moved into a sub-set that prevents all traffic to or from the internet (A6.6, A6.7).
What an assessor looks for
Cyber Essentials Plus test case 1 scans every public IP address you use, including IaaS, and judges each internet-accessible service it finds as a pass or a fail. A service you did not know was exposed is still part of your attack surface.
See the firewall requirements and secure configuration requirements. Related: internet-facing, unnecessary software, port.
Related terms
- Internet-facingInternet-facing describes a device or service that anyone on the internet can reach and try to connect to, such as a website, a VPN login page or an email server.
- Unnecessary softwareUnnecessary software is any program, built-in tool or background service on a device or cloud account that the business does not use.
- Port (network port)A port is a numbered doorway on a device that a particular kind of network traffic uses, for example secure web pages usually arrive on port 443.
- Authenticated scanAn authenticated scan is a vulnerability scan that logs in to a device, so it can see exactly which software and updates are installed.
- BackupA backup is a copy of your information saved to another device or to cloud storage, so you can recover it if the original is lost.
- Cloud serviceA cloud service is an on-demand, scalable service hosted on shared infrastructure, reached over the internet through an account, that stores or processes your organisation's data.
Frequently asked questions
An attack surface is every point where an attacker could try to get into your organisation: each internet-facing service, device, account and piece of software.
In the 2026 Danzell question set, attack surface comes up at A4.6, A4.7, A5.1, A5.2. Read those questions against the definition above so your answers use the term the way the assessor will.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.