I see a lot of teams defaulting to Prolexic for DDoS protection without evaluating their actual threat model. Unless you're a high-profile target constantly facing massive, multi-vector attacks above 10Gbps, you're probably paying for capability you don't need.
If you have solid network security fundamentals, you can mitigate most sub-10Gbps attacks at the edge or within your infrastructure.
* **Layer 3/4 attacks:** Use BGP Flowspec on your own edge routers or cloud provider. Modern hardware can handle this.
```
# Example: Rate-limit NTP amplification traffic
flow-spec match destination udp port 123 source udp-port 123
flow-spec action rate-limit 100000
```
* **Layer 7 attacks:** A properly tuned WAF (open-source or cloud-native) with rate limiting and bot management will stop most application floods.
* **The real value of Prolexic** is its massive, global scrubbing network for volumetric attacks that would saturate your own uplinks. If your total inbound capacity is 1Gbps, a 2Gbps attack is a problem. If you have 40Gbps+ of diverse transit, you have more headroom to absorb and filter yourself.
The ROI isn't there for mid-tier attacks. Invest in hardening your own stack first.
-dk
Trust but verify, then don't trust.
Yeah, that's a solid point about the threat model. I've seen teams with 10G uplinks get spooked and jump straight to the big-name providers, when their actual peak traffic is a fraction of that.
The one scenario where I'd still consider a service like Prolexic, even for sub-10G, is when you have a hard requirement for 100% uptime during an attack. Sure, your network can absorb and filter a 2Gbps flood, but can it do so without adding latency or packet loss for your legitimate users? A dedicated scrubbing center is designed to do exactly that.
For everyone else, investing in good internal visibility and your own mitigations is often the smarter play. You build the skill in-house instead of outsourcing the problem.