at this time’s quickly evolving menace panorama, conventional DDoS mitigation strategies are now not adequate for contemporary service supplier networks. In the variety of DDoS assaults almost doubled and community layer assaults almost tripled.1 Moreover, 78observed in 2025 lasted 5 minutes or much less2 making fast detection all of the extra very important. 31 Tbps in 2025, with AI-driven botnets like Aisuru and Kimwolf infecting thousands and thousands of gadgets to launch stealthy, high-impact campaigns.3
Guarding in opposition to evolving DDoS assaults: Cisco Safe DDoS Edge Safety
Cisco Safe DDoS Edge Safety helps organizations guard in opposition to these threats, providing a simplified structure that makes use of a modular, containerized design and turns your community edge right into a distributed safety defend.
Determine 1: Cisco Safe DDoS Edge Safety resolution structure
On-box detection and mitigation
As a substitute of exporting NetFlow knowledge to a central collector, clients can deploy Cisco Safe DDoS Edge Safety containers immediately on Cisco IOS XR routers to investigate the site visitors samples. Cisco extends the standard NetFlow to Protobuf, with extra parameters to be captured from the packet headers, which is able to assist allow:
- Extremely-fast response: Detection and mitigation happen in beneath 30 seconds.
- Zero added latency: As a result of the assaults are mitigated on the edge, there is no such thing as a backhauling to scrubbing facilities and no impression on reputable site visitors efficiency.
The system can even use superior machine studying (ML) algorithms to ascertain baselines for each host, successfully figuring out behavioral anomalies and neutralizing zero-day threats.
Complete use case assist
Cisco Safe DDoS Edge Safety equips organizations to protect in opposition to and reply to quite a lot of cyberattacks, whether or not inbound, outbound, or originating from east-west site visitors.
Peering (inbound)
Inbound peering site visitors is usually the goal of hyper-volumetric assaults designed to saturate infrastructure earlier than it will probably attain a scrubber. Dynamic detection algorithms re-characterize the protection logic based mostly on the assault vectors—in actual time as assault vectors change, defending the core from large L3–L7 volumetric floods.
Entry/broadband (outbound)
Botnets like Aisuru are infecting the top consumer buyer premises tools (CPE) to make use of service supplier networks as an “assault launchpad” for DDoS assaults, camouflaging as reputable site visitors. As soon as the origin of the assault is understood, the service supplier’s peering IP addresses get blacklisted. Because of this, it’s now not simply safety operations (SecOps) groups which have to fret about DDoS assaults; community operations (NetOps) groups should additionally take a extra central function in addressing DDoS points.
Cisco Safe DDoS Edge Safety identifies the assaults immediately on the entry router and mitigates them.
East-west site visitors
Cisco Safe DDoS Edge Safety closes the visibility gaps within the aggregation networks by monitoring inside site visitors, stopping malicious flows from spreading horizontally between customers and serving to service supplier networks keep away from choking.
Appropriate with routing platforms
Cisco Supplier Connectivity routing platforms (ASR 9000, NCS 5500 Collection, NCS 5700 Collection, NCS 540 Collection, 8000 Collection) have software internet hosting capabilities and run the Cisco Safe DDoS Edge Safety agent. These routing platforms empower groups to mitigate assault site visitors in a granular method with assault vectors fed into the user-defined fields of the entry lists. Moreover, the platforms additionally assist different conventional mitigation strategies of BGP Flowspec-based diversion or price limiting and BGP Remotely Triggered Black Gap (RTBH).
Decreased complete value of possession (TCO)
Cisco Safe DDoS Edge Safety helps save prices throughout the board, by avoiding devoted {hardware}, energy, and the internet hosting of scrubbers; it additionally eliminates the necessity for backhaul community capability to route the site visitors to centralized scrubbing facilities. Groups take pleasure in predictable and future-proof prices without having to add capability yearly. Sensible comparisons point out potential TCO financial savings of up to 60% in comparison with conventional scrubber-based deployments.4
Unlocking new income streams: The MSSP alternative
The resolution provides built-in assist for managed safety service suppliers (MSSPs) included with the license, permitting service suppliers to show DDoS safety into a possible income stream.
- Huge multi-tenancy: Onboard 10,000+ clients with full knowledge isolation.
- Tiered service fashions: Create tiered plans like Bronze, Silver, and Gold, with completely different service stage agreements (SLAs) and versatile detection and mitigation insurance policies.
- Customizable logic: Outline particular actions tailor-made to particular person buyer wants with the built-in scripting language.
- Buyer-facing portals: Present branded reviews and real-time dashboards that present the worth of the service throughout energetic assaults.
Getting ready for the subsequent era of DDoS threats
By integrating safety immediately into Cisco routers, you can scale back TCO, enhance buyer expertise, and make positive your community is prepared for the subsequent era of evolving DDoS threats.
-
2025 This autumn DDoS menace report: A record-setting 31.4 Tbps assault caps a yr of large DDoS assaults, Cloudflare, February 5, 2026.
-
DDoS in 2025: what a distinction a yr makes, TechRadar, January 13, 2026.
-
See word 1.
-
Potential TCO financial savings based mostly on Cisco calculations for a 4 Tbps peering community, evaluating Cisco Safe DDoS Edge Safety to Cisco estimates for a standard scrubber-based deployment.
Extra assets:
