Guide: Reducing Prolexic costs by tuning thresholds for our specific app.

Totally agree on the need for your own baselines. Your point about SYN floods is key - we realized our legitimate traffic could *never* hit some of those packet-per-second defaults because of our app's architecture, not just bandwidth.

One nuance we found: you can't just lower thresholds across the board. For example, we raised the threshold for certain application-layer attacks because our API has normal, bursty client syncs that looked suspicious. It was about aligning the sensitivity with actual user behavior, not just raw numbers.

Have you run into any issues with "low and slow" attacks slipping through once you tuned out the volumetric noise? That's my lingering worry after turning down the sensitivity dial.