Alright, let's cut through the marketing slides. Everyone says "real-time mitigation" and "sub-second response." Having run Prolexic in front of a few e-commerce platforms for the last couple years, my experience says those numbers are... situational.
From my logs, the *theoretical* best case—a known attack pattern hitting a well-tuned rule—is indeed under 10 seconds from first malicious packet to full mitigation on their scrubbing centers. But that's the happy path. The real delay creeps in with the weird stuff. The "low-and-slow" attacks, the application-layer junk that looks *almost* like legitimate traffic. If your rules are too loose, you're getting hit. Too tight, and you're the one causing an incident by blocking customers. Tuning that takes minutes to hours, and that's where the clock is really ticking.
Here's a concrete example from a past on-call. We saw a spike in 502s. Our own monitoring flagged it before Prolexic's portal updated. The attack was a mix of HTTP flood and slow POSTs. The automated system caught the volumetric part quickly, but the app-layer stuff slipped through because it was under the threshold of a rule we'd set to avoid false positives.
```
# Our own prometheus alert that fired first (sigh)
- alert: APIErrorRateSpike
expr: rate(nginx_http_requests_total{status=~"5.."}[2m]) > 50
for: 1m
```
I had to jump into the Prolexic portal, pull the real-time logs, create a custom signature for that specific pattern, and deploy it. Total time from first bad request to full mitigation? About 17 minutes. The DDoS was "mitigated" in seconds, but the part causing the actual outage took a coffee's worth of time to nail down.
So, the real-world delay isn't just their tech—it's your own configuration, visibility, and how you've defined "attack." The platform can block the obvious flood instantly, but the clever stuff requires you to be awake, have good diagnostics, and know where to tweak the knobs. Anyone else seen this gap between the "marketing seconds" and the "on-call minutes"? How are you structuring your rules to minimize that?