A DDoS incident is expensive whether or not it caused an outage: it consumes engineering hours, stress and attention. The only way to make that cost pay for itself is to learn from it systematically, and the tool for that is a postmortem written while the details are still fresh — ideally within 48 hours. Done well, it turns a bad day into a permanent improvement in how you detect and respond.
The Structure of a Good Postmortem
A postmortem is a document, not a meeting, and it follows a predictable shape so nothing important is skipped under the fog of a recent incident.
- Incident summary: what happened, when it started and ended, how long it lasted, and what was affected.
- Timeline: a minute-by-minute record of detection, escalation, each action taken, and resolution.
- Impact assessment: revenue lost, users affected, any SLA breach, and regulatory implications.
- Root-cause analysis: what let this attack succeed — or, if you stayed up, what protected you.
- What went well and what went wrong: honest notes on detection speed, communication, ownership and tooling.
- Action items: specific, assigned and time-bound, not vague intentions.
The Questions That Matter Most
Most of a postmortem's value comes from answering a handful of pointed questions honestly.
- When did we detect the attack, and how — a monitoring alert, or a customer complaint? (If it was a complaint, that is itself an action item.)
- How long between detection and the start of mitigation?
- Did protection activate automatically, or did it wait for someone to intervene?
- Was our origin IP exposed anywhere that let the attacker bypass our proxy?
- What information was missing that would have let us respond faster?
Blameless, always
Postmortems only work when no individual is blamed. Focus on what made an error possible, not who made it. People make reasonable decisions given the information they had at the time — so fix the information and the system, not the person.
Turning Findings Into Prevention
The action items are the whole point. Common ones after a DDoS incident: move from manual to automatic mitigation so response no longer depends on someone being awake; rotate and re-hide an origin IP that leaked; add or tune monitoring so the next attack is detected by a graph, not a customer; and write down the runbook step that was missing this time. Each item should have an owner and a date, and the next postmortem should check whether the last one's items were actually done.
This is also where a protection platform earns its keep after the fact. Akarguard keeps a detailed record of each attack — timeline, peak rates, attack type, source ASN distribution and the mitigation applied — plus a downloadable report, so your postmortem is built on measured data rather than half-remembered impressions. Automatic mitigation also removes one of the most common root causes entirely: the minutes lost before a human reacted.