Following are possible cybersecurity attack surfaces in a typical business software
- Website
- Webservers
- Database servers
- Cloud
- Network
- Source code
- APIs
- Host machines (hosting the servers)
- End points (such as your computers & mobiles)
- Email servers.
- Your mobile apps.
- 3rd party software
Though above is not a complete list, it covers majority of the software layers. For a deep level security, you should work towards securing all of the above.