The reachable and exploitable sum of every [[vulnerability]] in a system. Remember that people are also part of the system! There are three broad categories of attack surface: [[network]], [[software]], and [[human]].