Our three-year Prolexic (now part of Akamai Security and Compute) contract is up for renewal in Q4, and the initial conversation with our account team has already started with the expected "market adjustment" increase. In previous cycles at other organizations, I've found that simply threatening to walk isn't enough leverage with a premium DDoS provider, as the perceived risk of switching during an active threat landscape is high for management.
We have the standard threat reports and mitigated attack data from the Prolexic portal, which we'll use to demonstrate value. However, I'm interested in the less-obvious negotiation levers and technical preparation this community has found effective. Beyond the raw metrics, what specific operational or architectural data points should we be compiling?
My current list for internal preparation includes:
* **Comprehensive Traffic Analysis:** Establishing a clear baseline of our "clean" traffic patterns (requests/sec, bandwidth, concurrent connections) segmented by region and service. This is to audit any over-provisioning in our current committed volumes and push back on unnecessary uplift.
* **Configuration Audit:** Documenting every custom rule, rate control, and adaptive security policy we've implemented. The goal is to quantify the operational toil of potentially re-implementing these elsewhere versus their actual efficacy.
* **Cost of Alternative Architectures:** A rough design and monthly cost estimate for a hybrid model—perhaps using a cloud provider's native DDoS (e.g., AWS Shield Advanced, Google Cloud Armor) for layer 7, supplemented by a less expensive, always-on transit provider for volumetric attacks.
The specific areas where I'd appreciate concrete experience are:
1. **Pricing Model Flexibility:** Has anyone successfully moved from a committed bandwidth model to a more flexible "95th percentile" or usage-tiered model with Akamai, especially post-Linode integration?
2. **Service Scope Creep:** How have you handled negotiations around services that were initially "included" but are now being positioned as add-ons (e.g., more frequent threat intelligence feeds, specific API security features)?
3. **Technical Proof-of-Concept as Leverage:** Is running a limited-time POC with a competitor (e.g., Cloudflare, Radware) during the renewal period a credible tactic, or does it typically poison the well with the incumbent?
Our posture is to retain the service if the value is there, but we need to negotiate from a position of structured preparedness, not fear. Any insights on metrics that resonate at the board level, beyond just "number of attacks stopped," would be particularly valuable.
- Mike
Mike