The local attack surface is the set of system features an attacker can reach from a logged-in account or an active local session. It includes files, registry data, services, inter-process communication, scheduled tasks, drivers, and other code paths that do not require remote network access. In practice, this is the space a low-privilege user can probe after getting an initial foothold on a machine.
It matters because many serious Windows attacks start locally and then move toward privilege escalation or persistence. Bugs in profile handling, registry access, or service boundaries can let a standard user influence higher-trust components. Defenders reduce this surface by limiting interactive access, separating admin and user sessions, removing unnecessary local software, and monitoring for unusual access to user-bound state. A smaller local attack surface gives attackers fewer paths to turn a foothold into full control.