Attack Surface Reduction
Attack surface reduction is the practice of shrinking the number of ways an attacker can reach and exploit an organisation: removing unused services, closing exposed ports, decommissioning forgotten assets, and hardening what remains. It is the action that follows attack surface discovery and prioritisation.
Every internet-facing service, open port and forgotten subdomain is a potential entry point. Attack surface reduction is the discipline of continuously cutting that exposure down, so there is simply less for an attacker to find and exploit.
It depends on knowing your attack surface first. You cannot reduce what you cannot see, which is why attack surface reduction sits downstream of external attack surface management and continuous discovery.
Attack surface reduction is the practice of proactively shrinking the number of points at which an attacker could attempt to compromise a system, rather than only defending those points. Every exposed service, open port, enabled feature, user privilege and installed application is a potential entry route, and each one that can be removed or restricted is one fewer opportunity for an attacker.
Common techniques include disabling unused services and features, closing unnecessary open ports, removing or restricting software that is not needed, enforcing least privilege so accounts hold only the rights they require, and segmenting networks so that a foothold in one area does not grant reach to the whole estate. Hardening systems against recognised benchmarks, such as the CIS Benchmarks, is a structured way to apply many of these reductions at once.
Attack surface reduction embodies the security principle that the most reliable way to secure something is to remove it. A service that does not run cannot be exploited; a privilege that is not granted cannot be abused; a port that is closed cannot be scanned. Reduction therefore lowers risk in a durable way that does not depend on detecting or blocking an attack in progress.
Reduction complements the discovery-focused disciplines of attack surface management. ASM finds and monitors what is exposed; attack surface reduction acts on that knowledge to remove or harden the exposure. Together they form a cycle of continuously understanding the attack surface and then deliberately shrinking it, which is a core objective of exposure management programmes.
Structured hardening frameworks make reduction systematic rather than ad hoc. Benchmarks such as the CIS Benchmarks provide detailed, consensus configurations for operating systems, applications and cloud services, specifying which features to disable, which settings to enforce and which defaults to change. Applying a recognised benchmark removes a large amount of unnecessary exposure at once and gives an auditable baseline to maintain over time.
Some security products also offer named attack surface reduction controls; Microsoft Defender, for example, includes attack surface reduction rules that block common malicious behaviours such as certain script and macro abuses. Whether achieved through platform features, hardening benchmarks or deliberate architectural choices, the principle is constant: the most reliable way to secure a capability is to remove or constrain it, so that there is simply less for an attacker to reach.
Precursor surfaces your external exposure passively and prioritises it by the exploitation risk score, so your team reduces the exposures that actually carry exploitation risk first, with serious findings escalated to a CREST-certified team.