What is used to reduce attack surfaces?

Remediation addresses and corrects known vulnerabilities after they are identified, but it does not proactively reduce the attack surface by limiting reachability between systems.

Access control determines who or what can connect to resources, but without segmentation it does not inherently shrink the network surface area exposed to threats.

Segmentation partitions the network into distinct security zones using VLANs, firewalls, or micro-segmentation techniques, so that a compromised device cannot freely communicate with other parts of the network, directly minimizing the attack surface available to an adversary.

Device trust verifies the posture and identity of endpoints before granting access, which enforces policy, but it does not structurally reduce the attack surface the way segmentation does.