Topic starter
24/06/2026 11:01 pm
TL;DR: DNS traffic closed December at 4.75 trillion authoritative queries, DDoS attacks jumped to 176 in the month, and the largest event reached 2.02 Tbps, according to DigiCert’s Q4 2025 RADAR Brief. Availability planning now has to assume endurance under coordinated abuse, not just peak-volume mitigation, highlighting how sustained multi-layer pressure is now testing resilience across infrastructure and applications.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “Q4 2025 RADAR: Resilience Is Being Tested at Every Level”.
Key questions
Q: What should teams do if DNS outages start affecting authentication flows?
A: Contain the issue by validating the current records, confirming whether resolution is failing or being redirected, and switching to a trusted failover path if one exists.
Q: Why do short DDoS attacks still create serious operational risk?
A: Short attacks are often probes, not the full campaign.
Q: What do bot and cookie manipulation patterns tell defenders about application trust?
A: They show that attackers are probing session-state and trust logic, not just trying to flood a service.
Practitioner guidance
- Map identity dependencies to upstream DNS and availability paths Identify which authentication endpoints, federation flows, certificate checks, and machine-to-machine services depend on DNS stability so that outages and abuse are visible in the identity programme.
- Test mitigation stamina under prolonged DDoS conditions Run exercises that extend beyond the first hour of containment and verify whether tooling, staffing, vendor support, and escalation paths still hold after repeated attack waves.
- Review session integrity under automated abuse Reassess cookie handling, session validation, and trust assumptions in applications that remain exposed during bot-heavy traffic, especially where user and workload access converge.
Bottom line: The article shows that DNS, DDoS, and application-layer abuse now combine into a single resilience problem for digital trust.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:50 am
Resilience has become an identity-adjacent governance problem, not just an uptime metric. When DNS, DDoS, and application abuse converge, the issue is whether the organisation can still establish and sustain trusted access paths. That matters to IAM because access control is only meaningful if the service fabric supporting authentication and authorisation remains reachable. The practical implication is that identity governance teams must treat availability dependencies as part of trust architecture, not as someone else’s operational backlog.
A question worth separating out:
Q: What should practitioners do when resilience metrics do not reflect identity journey failures?
A: Add measures that link availability to access outcomes, such as failed login paths, broken federation flows, certificate-validation errors, and workload connectivity loss. If the service is up but the identity journey is degraded, the organisation is still failing trust. Reporting should show whether users and systems can complete access, not only whether infrastructure stayed online.
👉 Read our full editorial: Q4 2025 DNS and DDoS pressure is testing digital trust