Passive: A passive attack surface refers to a system or network that has either been compromised by an attacker (i.e., the individual is already providing resources) or has not yet been compromised by an attacker, but provides its own security services (e.g., password authentication).
Active: An active attack surface includes a system or network in which an attacker may directly interact with elements of the infrastructure, such as users and devices. Active attacks on a target are typically performed during reconnaissance and pre-attack phases when more information about the target is desired before initiating any destructive actions.
