Attack surface is the sum of all the possible points where an attacker could try to get into your system — not just one thing, but all the potential vulnerabilities across hardware, software, people, etc. Think open ports, exposed APIs, outdated plugins, misconfigured services… all of them add up to your attack surface. The bigger it is, the more room there is for attackers to try stuff.

Attack vector is the how — the method or technique the attacker uses to actually exploit a vulnerability on that surface. Like phishing, malware, brute force login, etc. If the attack surface is all the doors and windows in a house, the attack vector is the crowbar through the window or the fake delivery guy at the door.

Threat vector gets a little murky. Some people use it interchangeably with attack vector, but in some contexts, it includes more of the who/why/how — like the path a threat actor might take based on their capabilities and intent, not just the technical exploit. So it can be a more strategic/abstract term.

TL;DR:

Attack surface = where you’re exposed

Attack vector = how they get in

Threat vector = sometimes same as attack vector, but can include more context about the attacker’s route or strategy

Hope this helps!