This guest diary by Daryl Jiminez, an ISC intern in the SANS.edu BACS program, investigates the speed at which automated SSH threat actors can move from initial login to establishing persistence on a compromised system. The article highlights that the entire compromise chain can occur in as little as 22 seconds, before most defenders can even react. The research underscores the danger of automated attack tooling targeting SSH services exposed to the internet. It emphasizes how quickly attackers leverage valid or brute-forced credentials to deploy backdoors, create user accounts, or install malware. The findings stress the critical need for proactive SSH hardening, monitoring, and rapid automated response capabilities to counter such fast-moving threats.