Attack surface analyzer was made to analyse the changes made to the operating system’s attack surface by software installation. In other words, it will tell you the differences between two states of the same system; before and after a software installation. To do that, the attack surface analyzer has to run two scans. The first scan generates the first snapshot of the system state while the second scan will take the snapshot of the system after the changes are made.