36 minutes from power on to break in

New server. 36 minutes until someone was inside.

A fresh machine, no domain name pointing at it, no links, nothing published anywhere. Just an address and an open port. People assume a box like that has a grace period while nobody knows it exists.

Here are the two timestamps that matter. Online at seven fifty four. First contact at eight oh six, twelve minutes later, from a scanner that simply walks the address space. And at eight thirty, thirty six minutes after boot, an automated login succeeded with a password from a wordlist.

There is no grace period. The scanning is continuous and indiscriminate, and your server is found in minutes, not weeks. Whatever hardening you plan to do afterwards, do it before it goes online.

There is no quiet period. Harden before you expose.