A method of determining an attack surface of software, the method comprising: generating, with one or more processors, a platform for testing at least one deployment of software code; identifying, with the one or more processors, protocols that are used by the at least one deployment; mapping, with the one or more processors, the protocols to at least one port in the at least one deployment; performing, with the one or more processors, a static analysis of the at least one deployment to determine modules in the at least one deployment that open ports and deploy the protocols; collecting network traffic at the at least one port in the at least one deployment; determining, with the one or more processors, a plurality of parameters that correspond to the at least one deployment, wherein each of the plurality of parameters is determined based on one or more of the static analysis, the mapping of the protocols, the identifying of the protocols, and the collecting of the network traffic, wherein the plurality of parameters include: a number of unused ports in the at least one deployment, a number of open ports in the at least one deployment, information about at least one protocol used by the at least one deployment, a volume of traffic transmitted to external internet protocol addresses, IP, with respect to the at least one deployment, a number of choke points in the at least one deployment, a link traffic volume associated with the at least one deployment, percentage of paths that access sensitive information, and a mapping of protocols to nodes in the at least one deployment; and computing, with the one or more processors, a metric for the at least one deployment in which the metric includes the plurality of parameters wherein the metric represents the attack surface vulnerability of the at least one deployment. generating, with one or more processors, a platform for testing at least one deployment of software code; identifying, with the one or more processors, protocols that are used by the at least one deployment; mapping, with the one or more processors, the protocols to at least one port in the at least one deployment; performing, with the one or more processors, a static analysis of the at least one deployment to determine modules in the at least one deployment that open ports and deploy the protocols; collecting network traffic at the at least one port in the at least one deployment; determining, with the one or more processors, a plurality of parameters that correspond to the at least one deployment, wherein each of the plurality of parameters is determined based on one or more of the static analysis, the mapping of the protocols, the identifying of the protocols, and the collecting of the network traffic, wherein the plurality of parameters include: a number of unused ports in the at least one deployment, a number of open ports in the at least one deployment, information about at least one protocol used by the at least one deployment, a volume of traffic transmitted to external internet protocol addresses, IP, with respect to the at least one deployment, a number of choke points in the at least one deployment, a link traffic volume associated with the at least one deployment, percentage of paths that access sensitive information, and a mapping of protocols to nodes in the at least one deployment; and computing, with the one or more processors, a metric for the at least one deployment in which the metric includes the plurality of parameters wherein the metric represents the attack surface vulnerability of the at least one deployment.