The account you forgot about still works

That old account still works. Check it.

You hardened SSH, moved to keys, disabled password login. Then you look at the user list and find an account from a migration years ago, still there, still with a usable password. Nobody is logged in, so nothing looks wrong.

List every account by password status and filter for the usable ones. One line comes back, and it tells you everything: the account name, a usable password, and the date it was last set. Years ago, and it never expires. That is exactly the kind of account an attacker hopes to find. Locking it takes one command, and the status flips from usable to locked immediately.

Hardening the front door does not help if there is a second key under the mat. Audit accounts the same way you audit open ports.

Audit your users today, not after the incident.