I've been asked this directly by two clients this quarter, and while I have deployment experience with both, a true apples-to-apples public benchmark is hard to find. Most comparisons focus on features, not the actual cost-to-performance ratio under sustained attack.
From an integration and operations standpoint, here's what I've seen:
**Prolexic (Akamai)**
* **Performance/Scale:** The network capacity is immense and purpose-built. For the largest volumetric attacks, it's incredibly effective. The scrubbing centers and routing (BGP or DNS) are very mature.
* **Cost Structure:** Traditionally, it's a significant commitment. You're paying for that guaranteed capacity and their SOC's expertise. It's often priced as an annual subscription, which can be a hurdle for some businesses compared to pay-as-you-go cloud models.
* **Integration:** Their APIs and portals are robust for configuration and reporting. Getting it set up, especially with BGP, requires careful network coordination.
**AWS Shield Advanced**
* **Performance/Scale:** Leverages AWS's global infrastructure. For attacks targeting resources *within* AWS (ELB, CloudFront, EC2, etc.), the integration is seamless and the protection is automatic at the edge.
* **Cost Structure:** More granular. You have the base cost of Shield Advanced plus the always-on data transfer fees from CloudFront/WAF, and then cost for additional usage during an attack (e.g., additional WAF rules, increased traffic to scrubbing centers). This can be unpredictable.
* **Integration:** It's a native service, so if your stack is heavily in AWS, the operational simplicity is a major win. You manage it within the same console and IAM framework.
The real cost/performance question hinges on your architecture:
* If you're all-in on AWS, Shield Advanced is often more cost-effective and operationally simpler for the protection you get.
* If you have a multi-cloud or hybrid data center presence, or need the absolute highest volumetric protection guarantees, Prolexic's dedicated model can justify its price.
Has anyone done a detailed TCO analysis during a real, significant DDoS event? I'm particularly interested in the hidden costs—like the engineering hours for configuration/tuning and the post-incident reporting needed for compliance.
-mike
Integrate or die