Attack exposure is the degree to which a system can be reached or contacted by a potential attacker. It measures accessibility, not compromise: a service may be exposed through the internet, a remote access path, a flat internal network, or weakly segmented operational systems.
This matters because reachable systems are easier to scan, fingerprint, and target. In cyber security, exposure often becomes the first condition an attacker needs before exploiting a vulnerability, guessing credentials, or abusing misconfigured control channels. In data centers and other cyber-physical environments, exposure can affect power, cooling, building automation, or other operational technology, where disruption can hurt availability even if no data is stolen. Defenders reduce attack exposure by inventorying assets, removing unnecessary services, restricting remote access, isolating control networks, and enforcing strong authentication and monitoring for anything that must remain reachable.