An attack surface is the external digital profile of a business – anything that can be accessed without authorization. There is no benchmark for the success of an attack surface manager and no definitive list of weaknesses to look out for. However, any weak points should be logged and ranked for severity.