[_kbh_]

At least for AMD the PSP isn’t externally exposed which means the attack surface is drastically reduced.

[aqfamnzc]

When you say externally exposed, do you mean to the network, or physically exposed, or what?

[_kbh_]

It doesn’t sit on the network (unlike the ME) so an attacker needs to have access to the host already to be able to exploit any vulnerabilities on the PSP.