Attack surface is the collection of all points where a system can be reached, tested, or abused by an attacker. This includes obvious entry points like login screens, but also billing pages, password reset flows, APIs, device sync, and any feature that reads or shares data.
It matters because security risk grows as the attack surface expands. In a health app or account hub, a single identity can control subscriptions, connected devices, and sensitive records, so compromise of one exposed feature can affect the whole service. Attackers often target the weakest part of the surface with phishing, credential stuffing, fake renewal notices, or abuse of permissive data-sharing settings. Defenders reduce risk by removing unused features, tightening permissions, hardening authentication, and reviewing which services can access data.