A DDoS Mitigation Maturity Model, Level 0 to Level 5

Maturity models in security usually measure how much has been bought. This one measures how much has been verified, because in this field the gap between installed and working is where incidents happen.

The distinction shows up immediately: buying equipment moves an organisation from Level 1 to Level 2 and no further. Everything above that is earned with measurement and rehearsal.

At a glance

Appliance	Level	How you find out about an attack	What has been verified
0 — Unaware	A customer tells you	Nothing
1 — Reactive	Monitoring alerts, after impact	That someone can be reached
2 — Equipped	The mitigation device alerts	That the equipment powers on
3 — Calibrated	Thresholds derived from your own peaks	Legitimate peaks, and what the device does at its limits
4 — Rehearsed	Detection you have tested	Response, failover, and evidence export, by exercise
5 — Continuously verified	Detection you re-test on a schedule	All of the above, repeatedly, with the trend recorded

The third column is the model. Equipment moves you from 1 to 2 and no further; every level above that is bought with attention rather than capital.

Level 0 — Unaware

No detection specific to availability, no upstream relationship for this purpose, no runbook. An attack is discovered when someone calls, and the response is improvised.

This is more common than it sounds, and it is not always wrong. An organisation with no internet-facing revenue and a high tolerance for downtime may be correctly allocating attention elsewhere. It becomes wrong the moment availability starts to matter to someone and nobody notices the change.

Step to Level 1: volume alerting on the internet-facing path, and one named upstream contact. A day’s work.

Level 1 — Reactive

Monitoring exists and fires, though usually after users are affected. The upstream provider can be called and will do something, the extent of which is discovered during the call. No dedicated mitigation.

The characteristic weakness is elapsed time. The first thirty minutes of every incident are spent establishing who to call, what they can do, and who is allowed to authorise it.

Step to Level 2: decide whether dedicated mitigation is warranted. The readiness assessment and the sizing record answer this better than a supplier can, and the answer is sometimes no.

Level 2 — Equipped

Mitigation exists — an appliance, a service, or both. It has default thresholds. It has never been calibrated against the organisation’s own traffic, and the response has never been rehearsed.

This is where most organisations sit, and it is the most dangerous level in the model, because the equipment produces a feeling of coverage that has not been tested. Two failure modes are characteristic: thresholds set from vendor defaults refuse legitimate traffic at the first genuine peak, and thresholds set too permissively let an attack through while the dashboard shows green.

Step to Level 3: measure your own peaks over a full business cycle, then set thresholds from them. Weeks of passive measurement, one afternoon of decisions, no purchase.

Level 3 — Calibrated

Thresholds derive from measured legitimate peaks rather than from defaults. Someone knows the organisation’s own numbers: bits and packets per second at peak, new sessions per second, the packet rate the circuit can deliver, and what each stateful device does when its table fills.

Alerting distinguishes a busy day from an attack, because the baseline includes busy days. The division of responsibility between the upstream tier and the local one is written down.

Step to Level 4: rehearse. A tabletop with the people who would actually be called, then a controlled trigger of a real mitigation control in a maintenance window.

Level 4 — Rehearsed

Response has been practised with the actual on-call people. Failover or bypass has been triggered deliberately and its time measured. Evidence export has been performed by your own staff in the format a regulator or insurer would require. Decision authority for disruptive action is delegated in writing, with named alternates.

The KPIs are collected during exercises, not only during incidents, so the trend exists before it is needed.

Step to Level 5: put the rehearsal on a schedule, and re-measure after every material change.

Level 5 — Continuously verified

Everything at Level 4, repeated on a cadence, with the results trended. Thresholds are reviewed as traffic grows. Capacity is re-tested when the estate or the circuit changes. Post-incident findings produce changes that are implemented and confirmed.

The honest characterisation of Level 5 is that it is not a state but a habit, and it is the level organisations most often reach once and then lose, because the recurring commitment competes with everything else. Reaching it is a project; staying there is a budget line.

Using the model

Two rules keep it useful.

Score by area, not overall. Visibility, upstream, capacity, response, evidence and practice each have their own level, and the mismatch is the finding. Equipment at 4 with practice at 1 is a specific, expensive, common shape.

Never let a level be sold to you. Every level above 2 is defined by verification the buyer performs, so no product confers one. A supplier presenting their equipment as a maturity level is describing the one step that money can buy and skipping the rest.

The gaps to close first come from the readiness assessment, which asks what exists today. This model answers where to head next, and the two are meant to be used in that order.