AnalysisSC-2026-0305
DDoS volumes moved to the application layer
Network-layer floods are handled. Request-level attacks that look like real users are not.
SeverityModerate
6 minEnterprise CyberSec
Volumetric attacks are largely a solved commercial problem. The traffic that causes outages now arrives at request rate a human could plausibly generate, from residential address space, against endpoints that are expensive to serve.
Defence has shifted from capacity to cost asymmetry: find the endpoints where one request costs you far more than it costs the attacker, and make those the cheap ones.