DDoS protection services look remarkably similar on paper. Every sales deck promises "Tbps-scale scrubbing" and "global nodes," and every logo grid looks the same. But the real differences only become visible during the ten minutes that an attack is actually happening — when your monitoring is flatlined and a vendor's marketing copy is no help at all.
We have sat on both sides of this table. Here are five hard metrics you can take directly to vendors, plus the procurement traps that catch most buyers.
Metric 1: Scrubbing capacity — and whether it is actually usable
When a vendor quotes "10 Tbps of scrubbing capacity," do the math before you nod. If that figure is spread across 30 points of presence, you are really getting roughly 333 Gbps per site — and during an attack your traffic is diverted to only the one or two nodes nearest you, not the whole global fleet. Ask three follow-up questions:
- Is that total or per-site? Some vendors sum bandwidth across all global nodes for the headline number, but your attack only ever touches a fraction of them.
- Shared or dedicated? A shared pool gets crowded during large-scale campaigns — your neighbor's 2 Tbps attack silently eats the capacity reserved for you.
- What happens when you exceed it? This is the decisive question. Many providers blackhole (null-route) your service the moment you exceed your plan — the attack succeeds by default, and your customers see nothing at all.
AwayDDoS's approach: capacity is the aggregate of our global nodes with no hard per-customer cap. During attacks we never blackhole and never surge-price. Your plan fee stays fixed no matter how hard you are hit.
Metric 2: How many layers of architecture
Single-layer scrubbing struggles against mixed attacks: it may absorb a volumetric flood while L7 CC traffic slips through to your database, or focus on application-layer signatures while a UDP flood saturates your uplink. Attackers know this and switch layers mid-attack.
A two-layer cleaning architecture is the more mature design:
- Near-source scrubbing — dilutes volumetric floods (including NTP ~556x and Memcached ~50,000x amplification) close to the attack source, before they cross the ocean to you.
- Deep cleaning — performs fine-grained filtering on protocol and behavioral signatures, catching the spoofed packets and L7 traffic that the first layer lets pass.
That division of labor is what holds up against combined volumetric + application-layer campaigns. See the full explanation at Protection Solutions.
Metric 3: Pricing model — fixed or variable
This is the most commonly overlooked point during procurement, and the most painful afterward. We have seen customers receive a five-figure egress bill for the very attack they were paying to be protected from. Pin down the contract language:
- Is billing based on scrubbed traffic volume or a fixed plan fee? Watch for "you pay for all traffic we process," which means a 3 Tbps attack becomes a 3 Tbps line item.
- Does the price increase during an attack? Some vendors add emergency "incident fees" or per-Mbps overage charges the moment you are under fire.
- Are there minimum commitments or hidden bandwidth overage fees buried in the SLA?
Volume-based billing creates a perverse incentive: the worse you get hit, the larger your bill. Fixed pricing makes costs predictable and aligns the vendor's interests with yours — they are motivated to actually stop the attack rather than profit from the bandwidth it consumes.
Metric 4: Response time and expert operations
Attacks rarely start at a convenient hour. The 3 a.m. page is a cliché because it is true — and that is exactly when your defense is tested. At that moment, ask the vendor hard questions:
- Can you reach a human technician within minutes, or is it an auto-responder queuing tickets until business hours?
- Is it a ticket queue, or do you have a dedicated technical contact who already knows your topology?
- Does the vendor proactively intervene and tune policy during the attack, or must you file tickets repeatedly while the clock runs?
AwayDDoS provides 7×24 expert operations: our security team actively monitors and tunes policies during an attack rather than waiting to be paged.
Metric 5: Onboarding cost and compatibility
Even the strongest protection is worthless if adopting it requires re-architecting your stack mid-crisis. Evaluate honestly against your reality:
| Dimension | What to ask |
|---|---|
| Onboarding method | Just DNS changes? Or network changes and agents? |
| Time to effect | Minutes? Hours? Manual provisioning? |
| Compatibility | UDP game protocols? Non-standard ports? Your specific engine? |
| Origin return | Does it support your current origin topology (BGP, GRE, proxy)? |
| Migration cost | Can you leave at any time? Any lock-in or contract terms? |
Bonus: privacy and compliance
If your business handles user data or operates in a regulated industry, confirm whether the vendor logs your payload content, where that data is stored and under which jurisdiction, and what compliance certifications they hold. A scrubbing provider sees everything that passes through it.
Two procurement traps to avoid
Beyond the five metrics, two patterns repeatedly burn buyers:
- The "unlimited" reseller. Many small providers are themselves reselling capacity from a larger upstream. When a real attack lands, the reseller's upstream may blackhole them — taking you down with no warning. Ask who actually owns the scrubbing infrastructure.
- The no-SLA trial. A free or cheap plan with no response-time commitment is fine for learning, but never your production fallback. The time to discover "they don't answer at 3 a.m." is not during your biggest attack.
A quick checklist
Take this to every candidate vendor and see who answers without hesitation:
- [ ] Will you blackhole my service if the attack exceeds my plan?
- [ ] Will my price increase during an attack?
- [ ] Is your architecture single-layer or two-layer scrubbing?
- [ ] What is the concrete response-time SLA in minutes, and at 3 a.m.?
- [ ] Do I get a dedicated technical contact?
- [ ] What onboarding methods are supported, and how fast do they take effect?
- [ ] Do you log my payload content, and where is it stored?
Key takeaways
Choosing DDoS protection is really about choosing a partner you can rely on when things go wrong. Price and bandwidth figures are just the entry ticket. What actually determines whether you survive an attack is architectural depth, pricing honesty, and response speed.
To see AwayDDoS's full protection stack and fixed-fee model, get in touch for a consultative assessment. New to DDoS entirely? Start with What Is a DDoS Attack? A Complete Beginner's Guide.