Determining application attack surface for network applications

A device comprising:

• one or more memories having computer-readable instructions stored therein;
• and
• one or more processors configured to execute the computer-readable instructions to:
• receive information identifying open ports associated with an application;
• determine based on the information and common attack ports, an attack surface score for, and specific to, a workload of the application;
• determine whether to implement a policy for reducing vulnerability of the application to attacks to yield a determination based on the attack surface score;
• implement a vulnerability reduction policy based on the determination;
• close one or more open ports to yield updated information on open ports associated with the application;
• and
• determine an updated attack surface score based on the updated information.

A non-transitory computer-readable storage medium comprising computer-readable instructions which, when executed by one or more processors, cause the one or more processors to:

• receive information identifying open ports associated with an application;
• determine based on the information and common attack ports, an attack surface score for, and specific to, a workload of the application;
• determine whether to implement a policy for reducing vulnerability of the application to attacks to yield a determination;
• and
• implement a vulnerability reduction policy based on the determination;
• close one or more open ports to yield updated information on open ports associated with the application;
• and
• determine an updated attack surface score based on the updated information.