Attack surface

The total set of points where an attacker could try to get into or extract data from your organization, including devices, accounts, software, services and people.

Your attack surface includes every internet-facing service, every laptop and phone, every user account, every cloud application and every vendor connection. It also includes people, since staff can be targeted through phishing or phone scams. The larger and less managed the attack surface, the more opportunities an attacker has.

Small businesses often grow their attack surface without noticing. A remote desktop port opened for convenience during a busy season, an old website plugin, a forgotten test server or a former employee's still-active email account all add risk. Hybrid work has also stretched the attack surface into home networks across Alberta and beyond.

Practical tip: reducing your attack surface is often cheaper than defending it. Turn off services you do not use, retire old systems, close unnecessary remote access, and remove unused accounts and apps. An external vulnerability scan from your IT provider can show what your business looks like from the internet.