This is one of the reasons why I've started to call a good layer of concealment and deception on top of a hard system OPSEC rather than obscurity. It's a less a

This is one of the reasons why I've started to call a good layer of concealment and deception on top of a hard system OPSEC rather than obscurity. It's a less ambiguous term and probably more accurate. For example, I have no trouble revealing that all our SSHDs at work are ssh-keys only with a strong key policy and periodic reviews, whitelisted accounts, most are firewalled to be VPN only, configs are hardened periodically, some are 2FA secured. All in all, those are good or best practices to follow in order to harden an sshd, so I'm losing little info there. A pentester under NDA would get more info to be effective, like the whitelists, might get IP whitelisted even. Security audits during pre-sales might some other additional info. However some details and measures don't need to be known outside our operations team. But they can and have been a royal pain to visitors.