# Uptime SLAs and DDoS: What 99.99% Actually Means — and How to Achieve It > A 99.99% uptime SLA allows 52 minutes of downtime per year. DDoS attacks routinely cause hours of outage. Here's how to make your SLA real. - Category: Best Practices - Author: Akarguard Team, Security Engineering - Published: Sep 13, 2026 - Canonical: https://akarguard.net/blog/uptime-sla-ddos --- "Four nines" — 99.99% uptime — is the number production teams aspire to put in a contract. It sounds absolute, but it is a budget: 99.99% allows about 52 minutes of downtime per year, 4.3 minutes per month, roughly a minute a week. Put that next to a single DDoS attack lasting two hours and the maths is brutal — one incident can spend your entire annual downtime allowance in an afternoon. ## What an SLA Actually Costs in Downtime - 99.9% (three nines): ~8.8 hours of downtime per year. - 99.99% (four nines): ~52 minutes per year. - 99.999% (five nines): ~5 minutes per year — rarely achievable for a normal web stack. - A single unmitigated DDoS attack routinely runs from minutes to hours, so without protection any promise above three nines is optimistic. ## DDoS Versus the SLA Attack duration varies enormously — many are short, sharp bursts of a few minutes, while multi-hour attacks against finance, gaming and e-commerce remain common. The point is not the average; it is that you do not control it. If your uptime depends on a human noticing an attack and switching on protection, your SLA depends on reaction time you cannot guarantee. That is why the achievable ceiling for uptime is set less by your servers and more by how your protection behaves under attack. ## What It Takes to Make an SLA Real - Always-on protection: mitigation has to be in the traffic path before an attack arrives, not switched on afterwards. - Automatic escalation: protection should raise itself the moment an attack is detected, without waiting for someone to react. - No single point of failure: if your protection layer itself can fall over, you have only moved the risk. - Fast detection: the sooner an attack is spotted, the less of your downtime budget it spends. > **Read the SLA's fine print** — Not all SLAs mean what they seem. Many provider agreements explicitly exclude downtime caused by DDoS from the uptime calculation — so the attack that most threatens your uptime is the one the SLA does not cover. Always check the carve-outs before you trust a number. ## How Akarguard Approaches Uptime Akarguard is built around the two things that actually protect an SLA: protection sits in the traffic path via a DNS change so it is always on, and automatic mitigation escalates the moment an attack is detected rather than waiting for a human. We are honest about the promise itself: rather than printing a blanket "99.99%" on every plan, Akarguard offers an uptime SLA by agreement, and treats four-nines as an engineering goal you design toward — with always-on filtering, a hidden origin and automatic response — not a slogan. As always, the network-layer volumetric side is handled upstream by your host or transit provider, and belongs in the same availability plan. --- Source: Akarguard Security Blog (https://akarguard.net/blog). Akarguard provides DDoS protection: traffic is proxied through our edge, attack traffic is filtered, and clean traffic reaches your origin. Reuse of this article with attribution and a link to the canonical URL is permitted.