A vulnerable surface is any device (server, mobile device, computer, IOT device) that is 1. Connected to the internet, and 2. Has a vulnerability that could allow an attacker to run a program on it.