On March 10, 2025, X experienced multiple outages due to a large-scale DDoS attack. The attack succeeded because the DDoS protection deployed had a vulnerability that was exploited. While Elon Musk did acknowledge the severity of the incident – it remains unclear if X is taking the necessary steps to actively prevent the next DDoS attack.
DDoS remains one of the top cybersecurity concerns for CISOs worldwide. Research shows that DDoS attacks jumped 358% percent in the first quarter of 2025, compared to the same period last year.
The DDoS threat landscape is continuously shifting, with new threats and AI-enhanced attack capabilities resulting in new vulnerabilities daily. As a result, DDoS spend is increasing rapidly. In fact, the DDoS protection and mitigation market size is expected to grow from $4.7B in 2024 to $5.36B in 2025.
The following sections explore key evaluation criteria for selecting a DDoS vendor and provide insight into how to obtain customized DDoS mitigation for your organization.
How to Select the Right DDoS Protection Vendor
-
Evaluate the Capabilities of Each Solution
Organizations need proactive (continuous/always-on) DDoS mitigation. Always-on mitigation means that all traffic is inspected; and suspicious traffic is separated before it reaches the infrastructure, preventing it from going down. (Note that “always-on” does not mean 100% automatic protection.)
DDoS protection solutions must be able to mitigate DDoS attacks targeting the following levels of website infrastructure:
- Layer 3: Involves massive amounts of traffic – clogging the bandwidth, slowing the web or service performance, and, ultimately, slowing or preventing website access
- Layer 4: Saturating an end server’s CPU or connection table using a connection-oriented attack
- Layer 7: Exploiting weaknesses in the application layer – overwhelming the database or server powering the application directly
-
Assess for Scalability
DDoS providers need to provide defense against both large-scale volumetric attacks and smaller, sophisticated ones. The assumption that “more POPs = better protection” is misleading. The key is how well your solution is configured to your networking environment. Your vendor should be able to stop even a low-volume attack by continuously configuring your DDoS protection.
-
Check if SLAs Cover Remediation PRIOR to an Attack
It’s true that DDoS protection providers include SLAs to mitigate attacks and remediate DDoS vulnerabilities. Typically, these come into play only after an attack has occurred.
An SLA for remediating vulnerabilities is critical to recover from damaging downtime and is the key to finding the best DDoS vendor.
Look for:
- 24/7 SOC support
- Real-time incident response teams
- Continuous monitoring and proactive security measures
- SLA clauses that guarantee vulnerability remediation, not just attack mitigation
-
Follow the Selection Process for Finding the Right Vendor
To ensure you select the right vendor:
- Assess your organization’s needs: Is uptime critical for our business continuity? What is the financial and operational cost of downtime? How much are we willing to invest to avoid service disruptions?
- Engage stakeholders: Involve SOC team leads, network experts, compliance officers, and business leadership. Discuss reporting, visibility, and alignment with regulatory frameworks.
- References: Ask vendors for references and confirm if those organizations are still experiencing DDoS disruptions.
- Pilot the program: The best way to choose a vendor before purchasing is to conduct simulations during a proof-of-concept (POC) period.
- Establish clear SLAs and metrics: Ensure SLAs include continuous remediation clauses. This gap is often overlooked and leads to costly failures.
- Understand the limits of DDoS mitigation: Even with advanced protection, around 63% of DDoS vulnerabilities typically remain undetected due to a lack of adaptive policies and proactive testing procedures.
-
Compare Red Team Testing to Continuous Testing
“Always-on” is not the same as 100% automatic protection. To effectively block complex, adaptive threats, organizations need to validate and remediate their DDoS vulnerabilities during peaceful times – long before an attack hits. To be protected automatically, organizations must conduct remediation proactively – as there is no time to do this when an attack starts.
Note, however, the differences between Red Team testing and continuous testing:
- Relevance: Red Team DDoS testing typically occurs no more than a few times a year because it disrupts business continuity. Consequently, DDoS testing is relevant for only brief periods, typically less than 1-2 months. In contrast, continuous, nondisruptive testing ensures remediation and validation are effective.
- Scope: Red Team testing typically covers as little as 10-20 attack vectors and 4-5 IPs. Often, it misses large parts of your digital infrastructure. Compare that to continuous testing, which is unlimited – checking tens of attack vectors and tens if not hundreds of IPs at the same time.
- Business continuity: Red Team tests frequently are scheduled on weekends, affecting staffing and potentially leading to lost productivity and revenue. Continuous testing can be done at any time without causing disruptions.
- Visibility: Red Team testing provides insights into a fraction of an organization’s DDoS attack surface – normally less than 0.01 percent. Continuous testing provides full attack surface visibility.
-
Understand the Real Costs of Downtime for Your Organization
DDoS attacks cause direct damage (downtime and financial losses) as well as hidden damage such as brand damage, lost customers, and stock price impact – which are no less important.
A single DDoS attack is enough to cause damaging downtime. For example, a Layer 7 attack on an online financial services provider during peak hours can cause a few hours of downtime, millions in lost revenue, thousands of failed transactions, customer attrition, and media fallout.
By implementing continuous DDoS testing, organizations can identify vulnerabilities earlier, remediate them, and avoid downtime.
Automatic DDoS Protection is the Goal
Considering the prohibitive cost of downtime, choosing a DDoS solution isn’t just a matter of blocking bad traffic or volumetric attacks. It’s about ensuring resilience through continuous testing, automated detection, and guaranteed remediation.
This article was first published in GlobalSec.
Are you investing in DDoS protections but still suffering DDoS damage? Speak with an expert!
