There is no shortage of DDoS reports full of big year-over-year percentages. Most of them are hard to act on, and many mix a vendor's marketing with genuine measurement. This is the opposite: a qualitative read on the shifts that actually change how you should defend a site, with no invented figures. Where we cite numbers about our own network, we link to the live data we publish and nothing else.
Our real data
We do not claim an industry-wide dataset we do not have. The attacks we have measured on our own edge — counts, peak rates, type and severity — are published live and updated hourly at akarguard.net/ddos-statistics.
1. The attack moved up the stack
For years the headline threat was volumetric: fill the pipe with more traffic than it can carry. That still happens, but the centre of gravity has shifted to the application layer. Layer 7 floods send requests that look completely legitimate and are far cheaper for the attacker than raw bandwidth, because a single request can cost the server far more than it costs the client to send. The practical consequence: bandwidth alone is no longer a defence, and detection has to reason about behaviour, not just volume.
2. Attacks got shorter
The multi-hour siege is now the exception. Most attacks are short bursts — long enough to knock a service over, short enough to be gone before a human has finished reading the alert. This rewards automatic mitigation and punishes any design that waits for someone to flip a switch. If your protection needs a person to react, the attack is usually over, or has done its damage, before that person arrives.
3. Multi-vector is the default
Serious attacks rarely use one technique. They combine a volumetric component to saturate, a protocol component to exhaust connection tables, and a Layer 7 component to tie up the application — often shifting between them to find what is unprotected. A defence that only covers one layer simply moves the victim's problem to the layer it ignores.
4. Attacking is cheap; that is the real story
The single most important trend is economic. Attack-for-hire services rent flood capacity for the price of a meal, which is why the typical attacker is no longer a criminal enterprise but an ordinary person with a grudge — a lost game, a business dispute, a moderation decision. Low cost means high frequency, and high frequency means every public service is now a plausible target, not just the large ones.
What it means for defence
- Filter at the edge, before traffic reaches your server — you cannot out-buy bandwidth against a rented flood.
- Automate mitigation; short attacks leave no time for a manual response.
- Cover every layer, because multi-vector attacks probe for the one you left open.
- Hide your origin address, or the attacker skips your defences entirely.
- Keep records, so a repeat attacker — the common case — is something you can recognise and act on.
On the numbers you read elsewhere
Treat any single-vendor 'we saw X million attacks' figure as what it is: that vendor's own traffic, shaped by whom they protect, not a measurement of the whole internet. It is useful context, not ground truth. We hold ourselves to the same standard — which is why our numbers are published as live, self-described data rather than a headline in a report.