Just don't expose SSH to internet. It's a complex protocol with many CVEs. And you realyy don't need access to SSH from anywhere. Replace access from ineternet to a WireGuard tunnel that has almost zero attack surface area and properly configured iptables rules. And that’s it.