Serverless security

Serverless removes the server from your responsibility. It does not remove the code, the dependencies, the permissions or the data.

The attack surface changes shape rather than shrinking: more functions, more event sources, more identities, each with its own permissions. What goes away is patching the operating system, which is real and is not most of the work.