Attack Vector vs Attack Surface

What Is the Difference Between an Attack Vector and an Attack Surface?

The attack surface is where an attacker can try to get in. An attack vector is how they try.

NIST calls the attack surface the points on a system’s boundary “where an attacker can try to enter, cause an effect on, or extract data from” it. The wording comes from NIST SP 800-53 Rev. 5. Our attack surface glossary entry covers the term on its own.

NIST’s glossary has no entry for attack vector. The closest standard wording comes from MITRE ATT&CK, whose Initial Access tactic “consists of techniques that use various entry vectors to gain their initial foothold within a network.” In practice, an attack vector is the route or method: a phishing email, a stolen password tried on a VPN, or an exploit sent to a web server.

A building makes the split easy to see. The doors, windows, loading dock and the staff who open them are the surface. Picking a lock, following an employee through a door or talking a receptionist into a badge are vectors.

Every vector needs a point on the surface, and one point can carry several vectors. ATT&CK lists VPNs and Citrix under External Remote Services (T1133). The same gateway can also be hit with an exploit (T1190) or with stolen logins (Valid Accounts, T1078).

How Do Vulnerability, Exposure and Attack Path Fit In?

Several nearby words get mixed up with these two. The table follows one VPN gateway through all of them.

The definitions of exposure and attack path come from the CISA NICCS cybersecurity glossary. Most writing treats threat vector as another name for attack vector. NIST’s glossary defines neither term, and the standards used on this page do not separate them. A path strings several vectors and points together, which is also what the cyber kill chain describes stage by stage.

What Does Attack Vector Mean in a CVSS Score?

Vulnerability records use the same words for a narrower idea. In the Common Vulnerability Scoring System (CVSS), Attack Vector (AV) is a base metric. The specification says it “reflects the context by which vulnerability exploitation is possible.” The score rises the more remote an attacker can be.

• Network (N): exploitable across the network, “up to and including the entire Internet.” Such a flaw is often called remotely exploitable.
• Adjacent (A): the attacker must share a nearby network, such as Bluetooth, Wi-Fi or the local subnet.
• Local (L): the attacker needs local access, a terminal session such as SSH, or a user who opens a malicious file.
• Physical (P): the attacker has to touch the device, as in a cold boot attack.

AV is the first metric in a vector string. This one is the example used in the CVSS v4.0 specification:

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Here AV:N means the flaw can be reached over the network. The CVSS metric describes one flaw, while an attack vector in the wider sense describes an attacker’s route. They meet in practice: a flaw rated AV:N on a system that sits on your external surface belongs near the top of the patch list.

What Are Examples of an Attack Surface?

Teams usually split the surface by who can reach it. The external part answers on the internet. The internal part is reachable only after someone is inside, and the human and physical parts are people and places.

The third-party row is growing. Verizon’s 2026 Data Breach Investigations Report (DBIR) found a third party involved in 48% of breaches, up 60% on the year before. Our third-party risk entry explains how teams track it.

Inside a single application, the OWASP Attack Surface Analysis Cheat Sheet lists the entry points to map. They include forms and fields, HTTP headers and cookies, APIs, files, databases and admin interfaces. It adds that backups “are an important but often ignored part of a system’s Attack Surface.” Assets nobody listed, such as a test site from an old project, are shadow IT and still count.

What Are Examples of Attack Vectors?

MITRE ATT&CK v20.1 lists 11 techniques under initial access. The table shows the ones defenders meet most, with the part of the surface each one needs.

The technique descriptions quoted above come from ATT&CK’s Initial Access page. Some articles list malware or ransomware as vectors. ATT&CK treats them as what arrives, not as the route. Malware still needs one of these vectors to get in.

Our post on common ransomware attack vectors shows how ransomware crews get in.

How Do You Label Scan Findings as Surface or Vector?

An external scan and a dark web watch return a mixed list. Sorting each finding into surface or vector tells you who acts and how. The findings below are typical finding types written for a placeholder company on example.com, the domain reserved for documentation.

The pattern is simple. What you own and can switch off is surface. What an attacker holds or does is a vector. A scan mostly finds surface, while vectors show up in threat intelligence: leaked logins, new exploits, lookalike domains and access offers from an initial access broker.

What Does Real Data Show About Vectors and Surfaces?

Breach data points at a small set of vectors. In the executive summary of the 2026 Verizon DBIR, exploitation of vulnerabilities was the most common initial access vector, at 31% of breaches with a known initial access vector. Phishing stayed at 16% and credential abuse, the previous leader, fell to 13%. Pretexting reached 6%.

The same report counts critical vulnerabilities as those in the CISA Known Exploited Vulnerabilities (KEV) catalog. Only 26% of them were fully remediated by organizations in 2025, and the median time to a full fix rose to 43 days. The report uses 2025 data.

Our own data shows which surface those vectors land on. We read 120 unique corporate network access offers in Brandefense Blackhole, our cybercrime database, from posts dated 1 January to 27 October 2026. Firewalls or network devices led with 23 listings, then RDP and VPN with 12 each and RDWeb with 7.

One seller template, mostly firewall listings, repeats across 15 offers. Counting it once, 48 of 106 offers (45%) name a firewall, network device, Citrix, Fortinet, RDP, VPN or RDWeb. Admin, root or system rights are promised in 59 of the 120. Every field is a seller’s claim, as our field-by-field reading of corporate access listings explains.

Across all access offers, not only corporate network ones, most sit on websites and servers. In a sample of 44 offers from January to August, 23 were web shells and 7 were RDP. Our report on what initial access offers really sell has the detail, and the Initial Access chapter of the Cybercrime Report 2026 holds the full data.

Brandefense Atlas data shows the surface side. Our free PHP2Shell check ran 40,849 times on 30,027 sites between 21 and 25 October 2026. It reads the PHP version a site shows in its response headers.

That version was readable on about 12% of the sites, or 3,532. Of those, 2,071 (59%) showed a version older than the fixed releases. Visitors chose what to check, so this is not a random sample, and a hidden version is not a safe version.

On 29 October Palo Alto Networks Unit 42 reported PHP2Shell being exploited against PAN-OS management interfaces exposed to the internet. The flaw sat on many systems, but those reported attacks hit devices whose admin pages were on the internet. That is the kind of surface BOD 23-02 tells agencies to remove. Our PHP2Shell analysis keeps the timeline.

How Can You See Your Own Surface From the Outside?

You can start with public data before you buy any tool. These lookups are passive and send no attack traffic. We ran them on 10 November 2026 against example.com.

$ dig +short example.com MX
0 .
$ dig +short example.com TXT | grep spf
"v=spf1 -all"
$ curl -sI https://example.com | grep -i -E '^(server|x-powered-by)'
server: cloudflare
$ curl -s 'https://crt.sh/?q=example.com&output=json' | jq -r '.[].name_value' | grep -E '^[a-z0-9-]+\.example\.com$' | sort -u
dev.example.com
m.example.com
products.example.com
support.example.com
www.example.com
$ dig +short dev.example.com
$

crt.sh answers vary between requests. Another run also listed emudhra-lab.example.com.

• MX “0 .” is a null MX. Under RFC 7505 it states that the domain accepts no mail.
• “v=spf1 -all” authorizes no server to send mail as the domain, so spoofed mail fails SPF checks. Together the two records keep the domain small on the mail side. Our DMARC, SPF and DKIM entry explains the checks.
• The server header names only the delivery network in front of the site, not the software behind it. An X-Powered-By line would show the language and version, as in the PHP2Shell data above.
• Certificate logs list names such as dev, m, products and support under example.com. Only www.example.com resolved when we checked, and dev.example.com returned nothing.

Certificate logs remember names that DNS has forgotten, so check each one. A record that still points to a deleted cloud service can be claimed by someone else, which OWASP calls subdomain takeover. Port and vulnerability scans are active, so run them only on systems you own or have written permission to test. For the vector side, our free Domain Scanner grades one domain in about 30 seconds from leaked credentials, phishing domains and dark web mentions.

How Do You Shrink the Surface and Block the Vectors?

The two jobs need different work. Surface work removes places to attack. Vector work makes the remaining places harder to use and spots attacks early.

Shrink the surface:

• Keep one inventory of internet-facing assets, fed by DNS, certificate logs and scans, with an owner for each.
• Remove what nobody needs: old test sites, unused DNS records, forgotten cloud storage.
• Take management interfaces off the internet. BOD 23-02 asks US federal agencies to make them reachable only from an internal network, or to put an access control point in front of them.
• Put remote access behind MFA, and stop exposing RDP directly.
• Patch internet-facing systems first, starting with KEV entries.

Block and watch the vectors:

• Map the techniques seen against your sector to MITRE ATT&CK, and check which ones you can detect.
• Watch for your domain in stealer logs and access listings. Reset credentials and review logs when it appears.
• Watch for lookalike domains, and enforce DMARC so spoofed mail is rejected.
• Train staff for phishing and pretexting, including calls and text messages.
• When a new KEV entry appears, check which points on your surface it can reach that day.

Run as an ongoing program, the surface side is called attack surface management, and our attack surface reduction page covers the removal work. A good first step this week is to list your remote access gateways and admin interfaces and check who can sign in to each. Brandefense External Attack Surface Management scans internet-facing assets within minutes, and Cyber Threat Intelligence tracks the vectors aimed at them.