The relative attack surface quotient is computed for products to determine their relative susceptibility to attack. The relative attack surface can be calculated by identifying known avenues of attack that correspond to the product and by determining bias values that should be applied to the avenues of attack based upon desired criteria, including, the potential damage that can be caused by an attack. The appropriate bias is applied to each avenue of attack and the resulting bias-applied values are combined into a single relative attack surface quotient. The relative attack surface can be determined prior to or during utilization of a product. The product may include software, computing devices and networks. Upon determining a relative attack surface is too high, utilization of the product can be restricted.