All DDoS Definitions
DDoS Testing Definition

Attack Surface

Attack surface is a concept, the exposure inventory a thorough DDoS test is built to map before it drives any load. It is the full set of reachable endpoints, public IPs, open ports, protocols, DNS names, API routes, and dependent services that an attacker can address. For DDoS specifically, the attack surface includes every tier that can be saturated or exhausted: the network link, the load balancer, the TLS terminator, expensive application endpoints, and the authoritative DNS that resolves the whole thing.

Attack surface: every reachable tier is an addressable target The full inventory an attacker can address, both the tiers you enumerated and the ones you forgot. Reachable surface (enumerated) Network link / public IP (L3-L4) Load balancer (:443) TLS terminator (handshake CPU) App endpoints (/search, /api) Authoritative DNS (:53) Unenumerated (still reachable) Origin reachable by raw IP answers around the edge Forgotten staging host same app, no protection Each unseen host widens the surface a defender never scoped. A test enumerates the surface first, then scopes the exercise to the targets that actually matter. BlackNeuron™
Diagram of attack surface: the enumerated reachable tiers (network link, load balancer, TLS terminator, app endpoints, authoritative DNS) alongside the unenumerated raw-IP origin and forgotten staging host that widen it unseen

Why it matters in DDoS testing

You cannot defend, or test, what you have not enumerated. An origin that answers on a raw IP, a forgotten staging host, or an uncached search endpoint each widen the surface in ways a defender often does not see until it is flooded. A test begins by mapping this surface, then scopes the exercise to the targets that matter so coverage is deliberate rather than accidental.

How to scope that surface safely is covered in running a DDoS test without disrupting production.