How should attack surface analysis be designed for production?

For production, inventory endpoints and ports, identify privileged and internet-facing components, remove unused services, restrict administrative access, review third-party integrations, and repeat the analysis when architecture changes. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.