Attack Surface Maps

Pick any familiar system and it is really a set of moving parts passing data between them. Security can fail at any of those parts or any of the connections between them. These interactive maps make that visible: each diagram is annotated with numbered points, and tapping a point explains — in plain language — how it can be broken and how it is defended.

They pair naturally with the workshop: the maps show where things go wrong; the lab is where you find and fix a real one.

How to read a map

• Boxes are components; arrows are data flowing between them.
• Numbered dots mark where security can fail, colour-coded by severity: ● Critical · ● High · ● Medium.
• Tap any dot (on the diagram or in the list) to see its likely issues and its defenses.

The four systems

🛒 E-commerce Web Application Storefront, login, API, database, payments — and the third-party scripts in between.

📱 Mobile Application The app ships to the attacker's device: reverse engineering, permissions, fake apps, and banking trojans.

🚗 Connected Car Key fobs, the telematics cloud, infotainment, and the CAN bus — where failures become safety, not just data.

🔊 Connected Device (IoT) Smart speaker, treadmill, or bulb — the weakest device that opens the whole home network.

The pattern is the point

Look across all four and the same weaknesses keep reappearing — trusting the client, weak or default credentials, no encryption, too many permissions, unpatched software, risky third parties, and the human. Learn the pattern once and you can read the attack surface of almost anything.