SSH probing is the automated scanning or guessing of access on SSH services exposed to the network. Attackers use scripts or botnets to find hosts with port 22 open, test common usernames and passwords, and identify systems that accept weak credentials or misconfigured authentication. Because SSH often protects remote administration, successful probing can lead directly to full system access.
It matters in cyber security because SSH is a frequent target for initial access and botnet recruitment. Repeated login failures, login attempts from many IPs, or activity against devices that should not expose SSH are common warning signs. Defenders reduce risk by disabling public SSH where possible, using key-based authentication and multi-factor controls, limiting source IPs, and monitoring authentication logs for repeated or distributed attempts.