Topic starter
25/06/2026 2:45 pm
TL;DR: Two DDoS events peaking at 2.4 Tbps and 3.7 Tbps, an estimated 3,000 hours of prevented downtime, and malicious web activity rising from 51% to 73% show that scale and automation are now core attack variables, according to DigiCert. The security implication is that resilience planning must account for identity, DNS, and infrastructure interdependence, not just traffic volume.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “DigiCert Launches Inaugural RADAR Brief”.
By the numbers:
- Malicious web activity rose from 51% in July to 73% in September.
- September recorded 32 million bot violations.
Key questions
Q: What breaks when DDoS resilience is planned only around traffic volume?
A: Traffic-only planning misses the control-plane dependencies that decide whether an organisation stays reachable.
Q: Why does automation make modern DDoS attacks harder to contain?
A: Automation raises request volume, increases concurrency, and removes the delay defenders usually rely on for manual review.
Q: How do you know if your DDoS controls are actually working?
A: Look for whether the business stays reachable when upstream services are stressed, not just whether a mitigation platform reports blocked packets.
Practitioner guidance
- Model availability as a dependency chain Map DNS, application delivery, and identity services as linked failure domains so you can see where a DDoS event creates cascading outage rather than isolated saturation.
- Separate bot-driven traffic from human activity Tune detection and mitigation workflows for automated request patterns, because malicious web activity now dominates large-scale attack campaigns and can distort manual triage.
- Review DNS as a resilience control Validate DNS configuration governance, failover behaviour, and change control alongside uptime targets, because control-plane errors can intensify the impact of volumetric attacks.
Bottom line: DDoS resilience now depends on more than packet filtering because identity, DNS, and application delivery can fail together under sustained attack.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
25/06/2026 3:52 pm
Multi-terabit DDoS is now a resilience-governance problem, not a traffic-management problem. Once attacks reach 2.4 Tbps and 3.7 Tbps, the issue is whether the organisation has designed for dependency failure across DNS, application delivery, and identity-aware control planes. Traffic volume is only the symptom; the deeper issue is which services collapse first when the attack saturates shared trust and routing layers. Practitioners should model availability as a chain of identity and infrastructure decisions, not a single mitigation device.
A question worth separating out:
Q: What is the difference between DDoS protection and resilience governance?
A: DDoS protection is the technical mitigation layer that absorbs or filters attack traffic. Resilience governance is the broader discipline that maps which dependencies, including DNS and identity services, must keep functioning for the organisation to remain available under stress.
👉 Read our full editorial: Internet tsunami DDoS attacks expose the limits of resilience models
This post was modified 4 days ago by NHI Mgmt Group