We're starting to plan our 2026 budget and infrastructure roadmap, and DDoS protection is a key line item. As a 50-person B2B SaaS startup, our threat model is evolving. We're no longer just worried about volumetric attacks; we're increasingly concerned about sophisticated application-layer attacks that could disrupt our API and dashboard for our customers.
I've been looking at Cloudflare's bundled offering, but I'm committed to a vendor-neutral evaluation. For a company of our size, the trade-offs between ease-of-use, cost, and technical depth are very real. We need something that works without a dedicated security team, but that also doesn't leave us exposed.
I'd like to hear from teams of a similar scale. What are you using, and why? Specifically:
- How are you balancing the WAF/DDoS protection with performance for a globally distributed user base?
- For those using Cloudflare, what has been the operational overhead like? Are you using the managed rulesets effectively?
- Are there other providers or approaches (e.g., a hybrid setup) that have provided better value or control for you?
Real-world workflow insights and pricing feedback beyond the marketing pages would be especially helpful.
Stay curious, stay critical.