Move Over, DDoS: It’s the Era of Distributed Denial of Defense (DDoD)

Over the past few years, there has been a significant increase in the number of high-volume attacks that are highly sophisticated in nature.

In fact, nine of the largest volumetric DDoS attacks mitigated by Akamai Prolexic’s DDoS protection platform took place in the past 36 months. These attacks were often multi-vector, multi-destination attacks that had the potential to overwhelm many rudimentary, autonomous-only or on-prem DDoS solutions in the market.

If we look closer into the DDoS threat intelligence collected by Akamai, more than 30% of the DDoS attacks mitigated by Prolexic in Q2 of 2025 were sophisticated and horizontal (Figure 1).

Such sophisticated DDoS attacks require a sophisticated defense approach that combines the power of modern automation, human expertise, and collaboration among the security teams of an organization and the solution provider. This is where Akamai’s platform-people-processes framework offers robust network security posture. 

Simple, easy-to-mitigate vectors like UDP floods can be easily blocked by any rudimentary DDoS protection solution. No matter how many terabits per second (Tbps) of attack traffic is generated by an attacker. In many cases, even a simple access control list (ACL) can do the job. These types of simple tactics, techniques, and procedures (TTPs) are hardly anything new or noteworthy to network security practitioners.

An entirely different story are AI-enabled, sophisticated DDoS attacks that intelligently probe your defenses, identify weaker points in your security posture, and then launch a moderate-volume but complex mix of attack vectors. These attacks take your DDoS defenses down and then take your network offline.

We reiterate this particularly important process because DDoS is not a happenstance. A majority of DDoS attacks occur when someone deliberately attempts to flood your network with malicious traffic that saturates your origin’s capacity and prevents legitimate users from accessing your services.

In a few instances, there could be a denial of service (DoS) because of a misconfiguration, a network probe, or an aggressive vulnerability scan. With AI-enabled and assisted tools, cybercriminals can probe your network to detect which part is relatively vulnerable, and then they can concentrate the attack accordingly.

Sophisticated DDoS attacks are almost never high in volumetric terms. That’s because the attacker doesn’t have to generate a lot of traffic if it can overwhelm your defenses with a relatively moderate amount of carefully crafted malicious traffic.

Think of it this way: If someone were trying to break into your house, they could either use brute force to break through the front door, trigger the home alarm system, and be prepared to confront the police … or they could identify how to disable your security system and then use a moderate level of effort to break in.

Some of the modern DDoS attacks use the second technique: They disable your security system and then break into your network.

Customer networks often have different levels of redundant capacity or technology built-in so as to absorb or shunt the initial blow of an attack. Unfortunately, that’s not enough.

Controls or devices such as stateless firewalls, for example, can help initially but often have finite capacity to absorb protocol misuse and/or to distribute load equally while also concentrating on servicing legitimate hosts or users. Sometimes all an attacker needs is just enough attack capacity to bring down infrastructure and bypass automated controls.

A June 2025 report from FS-ISAC and Akamai, From Nuisance to Strategic Threat: DDoS Attacks Against the Financial Sector, highlights this trend in a detailed manner.

The report says, “Indeed, the most effective DDoS campaigns in 2024 were characterized by strategic reconnaissance and agile execution rather than simple volume.

“In 2024, threat actors increasingly employed advanced multi-vector DDoS strategies that incorporated systematic probing and adaptive tactics. This demonstrates an ability to analyze defenses in real time and dynamically adjust methods to evade automated protections. This marks a clear evolution in attacker capability, resources, and intent, and increases the threat of DDoS attacks against the financial services sector.”

In the final three months of 2024, more than 20 individual financial institutions in the Asia-Pacific region were impacted by an unprecedented and highly sophisticated DDoS attack campaign. Cybercriminals used a multitude of vectors at relatively low volume to skillfully probe and test the true level of DDoS defenses at these institutions.

Despite the moderate volume of attack traffic, the complex mix of vectors and destination IPs led to the failure of multiple purely autonomous and on-prem DDoS protection services, resulting in days of notable and expensive impact on end users.

It is important to note that the attack traffic volume was significantly below the advertised capacity limits of most DDoS mitigation solutions. Additionally, once the fully autonomous and self-service DDoS defense platforms were overwhelmed, customers could not even log on to these platforms to take any action. No network security personnel ever wants to feel this vulnerable and helpless.

Over the past few years, Akamai has closely observed this emerging trend of cybercriminals pivoting from the old game of distributed denial of service to the new sport of distributed denial of defense. The attacks in the Asia-Pacific region cemented this transition.

Once your automated DDoS defense system is down, the attacker does not need a high volume of malicious traffic to disrupt your network.

In the Asia-Pacific example, this approach allowed the attacker to successfully attack and disrupt multiple companies at the same time and over weeks. They used the “firing power” of their botnets in an economically efficient way, rather than exhausting their resources with conventional massive-size attacks.

Akamai Prolexic, our DDoS defense platform, comfortably defended customers from these attacks. One key reason is that we anticipate the failure of “automation only” in our design — there is always a global team of Security Operations Command Center (SOCC) experts monitoring attacks and working directly with the customer.

Our experts are people who fight DDoS attacks every day and have an arsenal of tools to deploy should an attack manage to overcome parts of the automated defense mechanisms.

In fact, Akamai regularly receives outside requests for emergency DDoS protection from organizations whose fully autonomous DDoS defenses were tricked by an attacker. More often than not, vendors that are dependent on fully autonomous defense systems offer neither a backup plan nor any access to human intervention, emergency consultation, or support resources.

A security system is only as good as its ability to defend your network at the time of an attack. Any system that regularly experiences outages, goes offline, or can be easily overwhelmed by a sophisticated attack is completely pointless, no matter how large their “marketed” defense capacity.

In the modern era of sophisticated DDoS attacks, it is relatively easy to overwhelm or completely disable purely autonomous DDoS defense platforms. This is particularly true when the DDoS defense capacity of such a platform is a shared resource with other services, including content delivery network (CDN).

A strategy that Akamai customers have grown to adopt is this idea of diversifying. Having purpose-built, multicloud architectures allows network security personnel to diversify their DDoS defense and avoid the risk of systemic issues across a single platform.

Many enterprise-grade organizations and institutions in some of the highly regulated industries require a dual DDoS vendor strategy.

In fact, many enterprise-grade customers choose a “good enough” second supplier to meet the diversity requirements but use a proven and well-engineered solution to protect their critical assets. The other assets, often including vanity domains, Q&A environments, and other noncritical functions, are reserved for the lower-cost solution.

We understand that any technology-based solution can experience unintended outages and thereby impact customers; we, too, have experienced outages in the past. But to what extent are you willing to place key or critically defined network assets behind a DDoS solution that may not be available when you experience an attack?

If 40% of your end users are unable to access your services but the DDoS mitigation provider claims that the internet-facing service is up, is that a reasonable outcome? The answer is a solid no.

Contact an Akamai expert today to learn more about our comprehensive security solutions.