Attack surface reduction is the practice of shrinking the number of paths an attacker can use to reach systems, services, or data. In practical terms, that means removing unnecessary software, closing unused ports, retiring old APIs, limiting public endpoints, and applying least privilege so every exposed function has a real business need.
It matters because attackers usually look for the easiest entry point, not the most elegant one. A smaller attack surface gives them fewer services to scan, fewer interfaces to exploit, and fewer credentials or tokens to abuse. Defenders use it alongside inventory, patching, and zero trust: first identify what is exposed, then decide what can be removed, restricted, or isolated. In real environments, this often means decommissioning legacy services, tightening API gateways, and deleting test or shadow systems before they become a foothold.