Understanding Attack Surfaces

Before taking the OMSCS cybersecurity course, I thought I had a reasonable understanding of security. We used HTTPS, sanitized inputs, signed JWTs, rotated secrets, ran vulnerability scans. Security felt like something you layered onto a system once the “real” engineering was done.