In a nutshell, attack vectors are directly correlated to an organization’s or potential victim’s attack surface. All of the attack vectors or insufficiently protected and thus vulnerable applications, devices, or people that threat actors exploit to get into a target network comprise the victim’s attack surface.
In straightforward terms, anything (attack vector) that makes an individual or organization prone to a cyber attack is part of the potential attack surface. Network insecurities due to ports left open and weak security protocols, software bugs, whether in internally produced or commercially available programs, physical security loopholes that include internal threats (e.g., rogue, dissatisfied, or irresponsible employees), and social engineering-prone staff are potential attack vectors that threat actors can take advantage of to compromise a target. All these attack vectors make up the network’s attack surface. The more attack vectors there are or the wider a network’s attack surface is, the greater the risk of becoming a cyber attack victim.