An attack surface analysis can extend across an entire system, which includes multiple sites and cloud platforms or it can be implemented on one site or even down to one server. So, the first step of an attack surface analysis is to define the boundaries of the study. The most important feature of a site is the data that bit holds and the software that accesses it, so once the boundary for the study has been stated, an exact list of software packages to be examined needs to be composed.