Attack surface

All the threat vectors into one organization added together: every internet-facing service, every person who reads email, every device plugged in. Turning off unused services and accounts makes it smaller.