Attack Surface
The complete set of points where an untrusted actor can interact with a system — and the quantity that reduction genuinely reduces risk.
It includes more than the obvious network endpoints: every API and its parameters, every file upload, every message consumed from a queue, every third-party callback, every dependency pulled at build time, every administrative interface, every credential, and every human with access.
The reason to enumerate it is that reduction is the most reliable security control available. Hardening an exposed component is ongoing work with uncertain results; removing the exposure is permanent.
The reductions that repay the effort:
Remove unused endpoints and features. Every deprecated API still routed is surface with nobody watching it — Equifax's breach was through a portal in exactly that condition. Restrict egress, not only ingress. Outbound restriction is what limits SSRF impact and data exfiltration, and it is the control most often skipped. Reduce data held. Data not collected cannot be stolen; this is the privacy control that is also the strongest security one. Shrink container images, removing shells and package managers that are useful only to an attacker. Remove standing privilege, replacing it with just-in-time elevation.
The habit worth building: when reviewing a design, ask what could be removed before asking what should be added.