This is a representation of the amount of exposure that a system has. For example, if a system is on the Internet it has a larger attack surface then a system that is internal. This is because more entities have access to the system on the Internet than do internally.