By regularly redeploying or re-imaging. Exploits can only live for a certain timescale + you can lock down nearly every entry point (no need for SSH access for instance).
Basically, you destroy a VM and spin up a new one with one of your images, it will then use chef or salt to pull in its config.
SSH isn't needed then.