Attack surface
Everything about your organization that an attacker could potentially reach and attempt to exploit.
It includes the obvious items, like the firewall and the mail server, and the ones nobody remembers: a forgotten test site, a vendor portal, an employee reusing a work password on a personal account, a printer with a web interface exposed.
It grows quietly. Every new SaaS subscription, remote worker, and integration adds to it, which is why periodic external discovery is more useful than a one-time inventory that ages the moment it is written.
Where this comes up
Attack surface sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.