# The State of DDoS: The Trends That Actually Changed > A plain-language read on where DDoS is heading — application-layer floods overtaking volumetric ones, shorter and smarter attacks, and cheap attack-for-hire. For our own measured numbers, we publish live data separately. - Category: Industry Report - Author: Akarguard Team, Security Engineering - Published: Sep 13, 2026 - Canonical: https://akarguard.net/blog/2025-ddos-threat-landscape --- There is no shortage of DDoS reports full of big year-over-year percentages. Most of them are hard to act on, and many mix a vendor's marketing with genuine measurement. This is the opposite: a qualitative read on the shifts that actually change how you should defend a site, with no invented figures. Where we cite numbers about our own network, we link to the live data we publish and nothing else. > **Our real data** — We do not claim an industry-wide dataset we do not have. The attacks we have measured on our own edge — counts, peak rates, type and severity — are published live and updated hourly at akarguard.net/ddos-statistics. ## 1. The attack moved up the stack For years the headline threat was volumetric: fill the pipe with more traffic than it can carry. That still happens, but the centre of gravity has shifted to the application layer. Layer 7 floods send requests that look completely legitimate and are far cheaper for the attacker than raw bandwidth, because a single request can cost the server far more than it costs the client to send. The practical consequence: bandwidth alone is no longer a defence, and detection has to reason about behaviour, not just volume. ## 2. Attacks got shorter The multi-hour siege is now the exception. Most attacks are short bursts — long enough to knock a service over, short enough to be gone before a human has finished reading the alert. This rewards automatic mitigation and punishes any design that waits for someone to flip a switch. If your protection needs a person to react, the attack is usually over, or has done its damage, before that person arrives. ## 3. Multi-vector is the default Serious attacks rarely use one technique. They combine a volumetric component to saturate, a protocol component to exhaust connection tables, and a Layer 7 component to tie up the application — often shifting between them to find what is unprotected. A defence that only covers one layer simply moves the victim's problem to the layer it ignores. ## 4. Attacking is cheap; that is the real story The single most important trend is economic. Attack-for-hire services rent flood capacity for the price of a meal, which is why the typical attacker is no longer a criminal enterprise but an ordinary person with a grudge — a lost game, a business dispute, a moderation decision. Low cost means high frequency, and high frequency means every public service is now a plausible target, not just the large ones. ## What it means for defence - Filter at the edge, before traffic reaches your server — you cannot out-buy bandwidth against a rented flood. - Automate mitigation; short attacks leave no time for a manual response. - Cover every layer, because multi-vector attacks probe for the one you left open. - Hide your origin address, or the attacker skips your defences entirely. - Keep records, so a repeat attacker — the common case — is something you can recognise and act on. ## On the numbers you read elsewhere Treat any single-vendor 'we saw X million attacks' figure as what it is: that vendor's own traffic, shaped by whom they protect, not a measurement of the whole internet. It is useful context, not ground truth. We hold ourselves to the same standard — which is why our numbers are published as live, self-described data rather than a headline in a report. --- Source: Akarguard Security Blog (https://akarguard.net/blog). Akarguard provides DDoS protection: traffic is proxied through our edge, attack traffic is filtered, and clean traffic reaches your origin. Reuse of this article with attribution and a link to the canonical URL is permitted.