Did most of the companies have external facing jump servers? I'd hope at least companies have internal-only and even then with strict internal network access policies (+VPN etc) and ldap authorization etc. Can't imagine that any competent orgs would have externally-facing ssh or windows bastion hosts.