An attack surface includes all possible points where an unauthorized user can try to enter data.