You&#x27;re describing the workflow of an APT attack. Those are extremely costly, take several months to complete and definitely involve highly technical skills. I agree they are a real threat, but not to startups, to Fortune 500 companies.<p>For startups, the #1 risk is a vulnerability in some web app, or a forgotten admin panel, that leaks the entire database to an attacker. Not a complex attack conducted by a nation-sponsored offensive team.<p>But again, SSH security matters, you should take it seriously.