GDPR and request logs: what we store and why (part 2)
gDPR and request logs: what we store and why sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.The numbersAcross the…
Rate limiting APIs without breaking legitimate integrations (part 2)
Here is a question we could not answer well a year ago: what really happens with rate limiting APIs without breaking legitimate integrations? We can answer it now.Protecting the originNone of this…
Preparing evidence for an ISO 27001 audit after an incident (part 2)
Over the last few months we have spent a lot of time on preparing evidence for an ISO 27001 audit after an incident. This is what we learned.Observability firstEvery mitigation decision is…
The economics of DDoS-for-hire in 2026
We get asked about the economics of DDoS-for-hire in 2026 more than almost anything else, so here is the long answer.Observability firstEvery mitigation decision is logged with its reasons, and every log…
How to hide your origin IP properly (part 2)
how to hide your origin IP properly sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.Protecting the originNone of this…
How we test WAF rules against seven days of real traffic (part 2)
Here is a question we could not answer well a year ago: what really happens with how we test WAF rules against seven days of real traffic? We can answer it now.The…
Scraper bots are getting better at pretending to be Chrome (part 4)
Over the last few months we have spent a lot of time on scraper bots are getting better at pretending to be Chrome. This is what we learned.Measuring successWe track three numbers…
Keeping search engine bots happy while blocking scrapers (part 2)
Here is a question we could not answer well a year ago: what really happens with keeping search engine bots happy while blocking scrapers? We can answer it now.Protecting the originNone of…
Per-tenant rate limits for SaaS platforms (part 4)
We get asked about per-tenant rate limits for SaaS platforms more than almost anything else, so here is the long answer.What we changedWe moved the decision from a single threshold to a…
Extortion DDoS campaigns target payment providers again (part 2)
We get asked about extortion DDoS campaigns target payment providers again more than almost anything else, so here is the long answer.What actually happens during a floodThe first thing to fail during…
QUIC and HTTP/3 at the edge: what changes for DDoS mitigation (part 2)
qUIC and HTTP/3 at the edge: what changes for DDoS mitigation sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.Lessons…
Bot management without CAPTCHAs (part 2)
bot management without CAPTCHAs sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.Compliance is a side effectRegulators increasingly ask for…