CapEx or Subscription: Two Ways to Pay for DDoS Protection

The argument is usually conducted as a cost comparison and settled by whichever spreadsheet was built by the party who wanted to win it. Both spreadsheets are typically correct, because both choose assumptions that favour the conclusion.

A more useful framing: each structure takes a specific risk and assigns it to one of the two parties. The arithmetic is worth doing, and then the decision is made on the assignments.

At a glance

Appliance	Dimension	Capital purchase	Subscription
Cash profile	Large at year zero, small thereafter	Level, and permanent
Sizing risk	Held by you, decided once, at purchase	Shared; adjustable, usually upward more easily than down
Obsolescence risk	Held by you, arrives around year five	Held by the supplier, priced into the fee
Renewal leverage	Limited to support; the device keeps running	Annual, over something you now depend on
Exit	Hardware remains; migration is planned	Ends with the term, which cuts both ways

The rows do not add up to a winner. Each structure moves a specific risk from one party to the other, and the question is which of those risks your organisation is better placed to carry.

What each structure actually moves

Sizing risk. A capital purchase requires the capacity decision to be made once, in advance, on a forecast. Over-buy and capital sits idle; under-buy and the shortfall appears during an incident. A subscription lets the decision be revisited — though the revision is usually easier upward than downward, and a subscription that cannot be reduced has moved less risk than it appears to.

Obsolescence risk. Hardware ages against attack volumes that do not stay still. A capital buyer holds that risk and meets it as a refresh decision around year five. A subscriber has transferred it, at a price embedded in the fee — provided a refresh commitment actually exists in the contract, which is the point to verify rather than assume.

Renewal leverage. This is the asymmetry that matters most for an availability control and gets discussed least. A capital owner whose support lapses has a device that still runs, an ageing one, and time to plan. A subscriber who declines a renewal price is removing the defence. Both parties understand this, and it shapes every renewal conversation for the life of the relationship.

The counterweight is real and worth stating: exit is easier from a subscription. Ending a term is straightforward, where a capital owner who chose badly is living with the choice or writing it off. The same mechanism that creates renewal leverage creates the freedom to leave.

Where the arithmetic actually goes

Build both structures in one model, with the same assumptions, and put every line item in.

For a capital purchase: hardware; initial licences; installation; annual support renewal as a percentage — and check whether it is calculated on list or on the price paid, because the difference compounds; one capacity step at a stated year; refresh or extended support at end of life; and the cost of capital on the initial outlay.

For a subscription: the annual fee; the capacity step’s effect on it; contracted uplift or its absence; any onboarding or professional-services charge; and exit or transition cost at term end.

For both: operator time, which is usually the largest number in the model and the one most often left out, and which does not vary much between the two structures. Its absence from a comparison is a good indication that the comparison was built to win rather than to inform.

The five-year cost model has these lines with nothing filled in. Every default is zero on purpose: a model arriving with supplier-supplied assumptions has already made the decision.

The three assumptions that decide it

Most of the divergence between two honest models comes from three inputs.

Support renewal percentage. Over five years this frequently approaches the original hardware cost and is the single largest source of disagreement between capital models.

Whether a capacity step occurs. A model with no growth flatters the capital case; one with a mid-term step usually narrows the gap considerably. Since attack volumes have grown over time, the no-growth assumption is the optimistic one.

Discount rate. An organisation with a high cost of capital genuinely prefers level payments, and one with cheap capital genuinely prefers to buy. This is a real difference between organisations rather than an accounting preference, and it is legitimate for it to decide the outcome.

Run the model at both ends of each assumption. If the winner changes, the decision was never about cost.

When each is clearly right

Capital purchase where budget cycles favour capital over operating expenditure; where a long refresh horizon is realistic because the traffic profile is stable; where the estate is under an obligation that makes continued operation independent of a live commercial relationship important; and where the organisation has the operational maturity to run the thing itself.

Subscription where capacity requirements are genuinely uncertain; where the balance sheet prefers level cost; where refresh is a burden the organisation would rather not manage; and where the ability to leave in twelve months is worth more than the ability to keep running without paying.

Neither is a default, and a supplier presenting one as the modern choice is describing their revenue model rather than your requirement.

The clauses to negotiate at the start

Whichever structure is chosen, four terms are cheap to obtain at signature and expensive to obtain later:

1. Renewal uplift cap, expressed as a percentage or an index, for the full expected life.
2. Expiry and lapse behaviour, with a grace period stated as a number of days.
3. Capacity step pricing, fixed in advance rather than quoted at the time of need.
4. Exit terms: what you keep, what stops, what is returned, and over what period.

Clause two is the one that turns a commercial term into an availability property, and the reasoning behind it is the fail-operational argument. The mechanics of the underlying licence types — what is metered, what renews, what can stop — are in licensing models explained, and the wider question of what an on-premises tier does to costs elsewhere in the estate is the TCO argument.