# Attack Surface Map Template

## Engagement

| Field | Value |
|---|---|
| Client | [CLIENT] |
| Reference | [REF] |
| Date | [YYYY-MM-DD] |
| Scope Source | SEAD / Scope document |

## Executive Snapshot

| Metric | Count | Notes |
|---|---:|---|
| Root domains | 0 | |
| Subdomains | 0 | |
| Live web apps | 0 | |
| APIs | 0 | |
| Exposed admin panels | 0 | |
| Cloud assets | 0 | |
| High-priority assets | 0 | |

## Asset Inventory

| Asset | Type | Exposure | Tech | Owner | Priority | Evidence |
|---|---|---|---|---|---|---|
| [asset] | web/api/cloud/network | internet/internal | [stack] | [owner] | H/M/L | [path] |

## Attack Surface Categories

### Web Applications

| URL | Status | Auth Required | Technology | Notes |
|---|---:|---|---|---|

### APIs

| Endpoint | Protocol | Auth | Documentation | Notes |
|---|---|---|---|---|

### Network Services

| Host | Port | Service | Exposure | Risk |
|---|---:|---|---|---|

### Cloud Assets

| Provider | Resource | Public? | Identity Risk | Notes |
|---|---|---|---|---|

## Priority Queue

| Priority | Asset | Reason | Recommended Skill |
|---:|---|---|---|
| 1 | [asset] | [reason] | [rt-skill] |

## Evidence Index

| Evidence | Source | Hash | Notes |
|---|---|---|---|

