87% of enterprise servers accept inbound RDP or SSH connections from broad internal sources, giving attackers wide access pathways once inside the network.

SSH is the second most common protocol observed, with rising usage in nearly every sector except retail.