Attack surface
Everything a hostile party can reach: apps, IT, OT, services. Bigger surface, more raffle tickets.
Attack surface is the set of applications, IT, OT, and services a system exposes. The larger it is, the more chances a hostile party has to find a usable weakness.
Shrink it: turn off what you do not need, patch what you do, keep admin interfaces off the public internet, and inventory the shadow SaaS. You cannot defend a surface you have not listed.
Fact source: ASD's ACSC glossary.