Here is a question we could not answer well a year ago: what really happens with data residency for public-sector customers? We can answer it now.
Compliance is a side effect
Regulators increasingly ask for evidence of resilience, not just promises. An incident timeline with start, peak, vectors and impact is exactly the evidence DORA and NIS2 ask for — and it falls out of good observability for free.
We export incident reports in formats auditors can file without anyone rewriting them.
The economics behind it
A booter service rents out a 100 Gbps attack for less than the price of a pizza. Defending against it with bandwidth alone is a race you lose. Defending against it by making each malicious request cost more than it earns is a race you win.
This is the entire idea behind never metering attack traffic: our costs scale with filtering, not with your invoice.
Testing in production, safely
Every rule starts in log mode. We replay the previous seven days of traffic through it and show exactly which requests it would have affected before anyone can promote it to challenge or block.
This one feature has prevented more incidents than any detection we have ever shipped.
Measuring success
We track three numbers for every incident: time to mitigation, the share of attack traffic that reached the origin, and the share of legitimate traffic that was challenged. The first should be under a second, the second under 0.1% and the third under 1%.
Those numbers go into every incident report, and they are the same numbers we are measured against in our SLA.
Protecting the origin
None of this matters if the attacker can reach your origin directly. Historical DNS records, certificate transparency logs and misconfigured subdomains leak origin addresses all the time.
Allow-list the edge ranges, enable authenticated origin pulls and treat any origin IP that ever appeared in public DNS as burned.
{ "match": { "path": "/account/reset", "risk": ">= 43" }, "action": "challenge" }
As always, questions and corrections are welcome at [email protected].
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.
Great to hear, thanks for sharing your experience.
Could you share the dataset behind the percentages?
The billing model is what got our finance team on board, honestly.
This matches what we see in iGaming around big matches.
Is the risk score exposed in the logs so we can build our own dashboards on it?
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.
Great to hear, thanks for sharing your experience.
How do you avoid challenging uptime monitors and partners?
Interesting that most attacks are under ten minutes. Our experience is similar.
Verified good bots and allow-listed partners bypass challenges entirely.