The External Attack Surface is the total number of entry points (Attack vectors) where an adversary can attempt to gain entry to your network or systems. It usually includes things such as IP addresses, netblocks, domains and subdomains, open ports and services, associated vulnerabilities, external facing web applications and APIs and more. It really is anything that could potentially be leveraged by an adversary to use in an attack.