What is the difference between an attack vector and an attack surface?

Attack vectors are flaws in configuration, and the attack surface is the system or software that has such flaws.

The attack vector targets security weaknesses, and the attack surface is where an adversary attempts to gain entry across those weaknesses.

The attack surface is tactics, techniques, and procedures used by the threat actor, and the attack vector is the system hardware.

The attack surface defines the number of existing vulnerabilities available, and the attack vector determines the difficulty of available exploits.