Initial Review: Simplifying Attack Surface Scoring for Software Systems

Software attack surfaces, the entry points and channels through which a system can be compromised, are a critical aspect of security, yet they are notoriously difficult to quantify. This paper introduces a scoring mechanism that produces a normalized, objective attack-surface metric in the range of 0-1. Building on the established Damage-Potential-toEffort ratio, our model integrates findings from static analysis tools with real-world vulnerability intelligence from MITRE's CVE and CWE repositories. It computes a score by weighing each vulnerability's potential impact against the attacker effort required for exploitation. To demonstrate its core functionality, we validate the scoring system on representative projects with differing sizes and vulnerability profiles. The resulting metric provides development and security teams with a practical tool to benchmark applications, monitor risk over time, and proactively manage their security posture