An SSH bastion is a controlled jump host that sits between users and private systems. Instead of connecting directly to internal servers, administrators first log into the bastion, then reach the protected network from there. This narrower access path reduces exposure, centralizes authentication, and creates a clear place to enforce logging, key management, and session controls.
In cyber security, bastions matter because they are high-value gateways: if an attacker steals credentials or gains a shell on a system that can reach the bastion, they may use it to pivot into more sensitive infrastructure. Defenders therefore treat bastions as hardened assets, restrict who can use them, and monitor for unusual SSH activity, new keys, and rapid lateral movement. In real attacks, a compromised application or notebook host may become the bridge to a bastion, turning a local flaw into broader network risk.