We get asked about the economics of DDoS-for-hire in 2026 more than almost anything else, so here is the long answer.
Compliance is a side effect
Regulators increasingly ask for evidence of resilience, not just promises. An incident timeline with start, peak, vectors and impact is exactly the evidence DORA and NIS2 ask for — and it falls out of good observability for free.
We export incident reports in formats auditors can file without anyone rewriting them.
What we changed
We moved the decision from a single threshold to a continuous score, added an explanation to every decision and made every rule testable against historical traffic before it goes live.
The result is fewer late-night pages for our analysts and — more importantly — fewer real users challenged by mistake.
The numbers
Across the last quarter, 71% of challenged clients never attempted a solution, 24% solved one challenge and then behaved normally, and 5% solved challenges repeatedly while continuing to attack — the last group is where analysts spend their time.
Median added latency for legitimate visitors that were challenged was 280 ms on desktop and 410 ms on mid-range Android devices.
What we got wrong
Our first version challenged too eagerly on mobile networks, where thousands of real users share a handful of carrier-grade NAT addresses. Reputation that is shared is reputation that is noisy.
We now weight fingerprint consistency and session behaviour far more heavily than IP reputation for traffic from known mobile carrier ranges.
{ "match": { "path": "/wp-login.php", "risk": ">= 53" }, "action": "challenge" }
The full incident data behind this post is available to customers in the dashboard under Reports.
Great write-up. We saw almost the same pattern on our login endpoint last month.
Good question. We will cover that in a follow-up post.
Carpet bombing is nasty. Good to see a clear explanation of it.
Interesting that most attacks are under ten minutes. Our experience is similar.
The billing model is what got our finance team on board, honestly.
Is the risk score exposed in the logs so we can build our own dashboards on it?
Would love a follow-up on how you handle HTTP/3 fingerprinting.
Good question. We will cover that in a follow-up post.
Our auditors asked for exactly this kind of incident evidence under DORA.