The attack surface is everything an attacker might try to use to gain access or cause damage.
Think of websites, mail servers, cloud environments, APIs, VPNs, old domains, forgotten test environments and incorrectly configured services. The better you know that surface, the more targeted protection you can provide.
Also read Why is continuous insight important?.