Surface, Vector or Vulnerability?

About this interactive

These three fit together, and the trick is to hold them apart. The attack surface is the whole of it — every door, port and login an attacker could try, taken together. A vulnerability is a weakness in one of those: a broken lock, an unpatched bug, a guard who breaks at a predictable time. An attack vector is the single route the attacker settles on, usually the one a vulnerability opened up: the unlocked roof door they decided to climb to, the phishing email chosen as the way in. Read the description for scope: the entire set of ways in is the surface; a flaw or weakness is a vulnerability; one route chosen or decided on is the vector.

What you'll learn

Tell apart the attack surface (all the entry points together), an attack vector (the one route chosen), and a vulnerability (the weakness that makes a route usable), using physical and digital examples
Explain how an attacker reads the surface, finds a vulnerability, and picks a vector

Aligned to

CompTIA Security+

2.2 Explain common threat vectors and attack surfaces.

4.3 Explain various activities associated with vulnerability management.

Key terms

Attack Surface: The total set of points in a system where an unauthorized user can attempt to enter or extract data.
Attack Vector: The specific path or method a threat actor uses to gain unauthorized access to a system or network, such as a phishing email, an unpatched vulnerability, or a misconfigured network port.
Vulnerability: A weakness in a system, application, or process that can be exploited by a threat actor.
Exploit: A piece of software or technique that takes advantage of a vulnerability to gain unauthorized access or cause harm.

Topics

Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →