How many remote code execution exploits have we seen on webs applications? Many thousands. But you don't need to make this trade off. SSH does not need to be o

How many remote code execution exploits have we seen on webs applications? Many thousands. But you don't need to make this trade off. SSH does not need to be open to the internet to begin with - make it only accessible via VPN. Now you don't have log spam from botnets in your logs, and it won't show up on a port scan that has fingerprinting enabled and scans the whole range, and you won't be as vulnerable if some sort of sshd exploit comes out that allows you to bypass auth.