The DDoS Mitigation Vendor Landscape, by Architecture

Most vendor comparisons start with a list of products and work outward. That order is what produces shortlists of fifteen names that never converge, because it asks a buyer to distinguish between things that are not alternatives to each other.

The categories below answer different failures. Once you know which failure is yours, most of the market stops being relevant and the remaining choice is tractable.

The categories

Appliance	What it answers	What it cannot answer	Decision it takes away from you
On-premises appliance	Protocol-state and application-layer attacks, immediately, on your own evidence	Volume larger than the circuit feeding it	None — you keep the decision and the operational burden with it
Cloud scrubbing	Volume at a scale you would not build	Judgements that need your own application history	Classification, and the schedule on which you receive telemetry
CDN-led protection	Attacks against what already passes through the CDN	Anything reaching your origin by another path	Where TLS terminates, and therefore where the plaintext is
Carrier managed mitigation	Saturation before it reaches your circuit	Attacks that are small, slow or application-shaped	The threshold, and often the visibility into why it fired
Hybrid	Both volume and local judgement	Nothing structurally, if the boundary is designed	Depends entirely on who owns which tier

The third column is the one most often skipped in an evaluation, and it is the one a regulator or a post-incident review will ask about.

On-premises appliances

A device at your own edge, seeing your traffic in full and deciding locally. This is the category that answers protocol-state and application-layer attacks without a diversion delay, and that keeps the telemetry on hardware you own — which is what makes it the usual answer where evidence custody or data residency is a stated requirement.

Its ceiling is physical and does not move: no appliance absorbs more volume than the circuit feeding it delivers. Any design in this category needs an upstream answer for saturation, and the only real question is whether the same supplier provides it.

Cloud scrubbing and network DDoS providers

Capacity at a scale it would be absurd to build, applied to traffic diverted into it. This is the category that answers volume, and volume is the part you structurally cannot answer yourself.

What it does not naturally hold is the history of your specific application, and what it does not naturally give you is telemetry on your own schedule. Both are contractual questions rather than technical limitations, which means they are answerable in procurement if you ask before signing.

CDN-led protection

Protection delivered as a property of a content delivery network. It is strong against attacks aimed at what already passes through the CDN and structurally blind to anything that reaches your origin by another path, which makes origin-address concealment part of the design rather than an optional hardening step.

It also terminates TLS by construction, which turns a technical property into a jurisdictional one for anyone with a data-protection obligation.

Carrier and ISP managed mitigation

Mitigation performed by the network that carries your traffic, usually as a service attached to transit. It is the fastest possible answer to saturation because it acts before the saturation reaches you, and it is bounded by the carrier’s own network and by the granularity of the thresholds they will operate on your behalf.

The properties to establish are the ones that get skipped: what triggers it, who decides, what visibility you receive, and what happens to legitimate traffic while it is active.

Hybrid patterns

Any deliberate combination of the above. The design question is not whether to combine but who owns which decision and what continues to work when one part is unavailable — the argument worked through in cloud versus on-premises versus hybrid and, for the supplier-concentration half, two layers from two manufacturers.

Products profiled on this site

Listed alphabetically. Each profile uses the same fields, the same evidence labels and the same “not publicly documented” semantics, so they can be compared on your criteria rather than on ours — the rules behind those labels are set out in the data methodology.

• A10 Thunder TPS / A10 Defend A10 Defend — mitigation density for scrubbing-centre designs.
• Corero SmartWall Corero Smartwall ONE — automatic sub-second mitigation, and enforcement in existing Juniper routing hardware.
• Fortinet FortiDDoS Fortinet Fortiddos — hardware-accelerated inspection inside a single-vendor operational model.
• HARPP DDoS Mitigator — L3–L7 in one appliance, local detection, per-customer profiles on shared hardware.
• NETSCOUT Arbor Edge Defense Netscout AED — stateless inline edge filtering within a larger ecosystem.
• Radware DefensePro Radware Defensepro — behavioural detection with real-time signature generation.

Cloud and CDN-led options referenced elsewhere on this site include Cloudflare Magic Transit Cloudflare Magic Transit and Akamai Prolexic; neither is profiled to the same standard yet.

One profile differs from the others. The HARPP profile does not link the manufacturer’s own documentation, which every peer profile here does; the reason is stated on that page, and the consequence is that its claims are marked vendor-stated or not publicly documented and have not been confirmed against a primary document. That is a difference a reader should weigh rather than one this page will smooth over.

How to use this landscape

Work in this order and the shortlist writes itself.

1. Find the smallest circuit in the path. That is your ceiling, and it decides whether an upstream tier is optional or mandatory.
2. Measure your normal peak in packets as well as bits. Packet rate is what most under-sizing comes from.
3. Write down what evidence you must be able to produce, and how quickly. This decides whether classification can happen outside your control.
4. Count the people who can respond at 3am. This decides how much automation you need and how much manual nuance you can actually use.
5. Only then look at products, and require the same fields from each.

The appliance comparison does step five for the on-premises category, and the five-year cost model is where most shortlists are finally decided.

Sources