Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants
Curated from Cloudflare Blog
The 2026 Q3 report highlights a significant tactical pivot in DDoS operations. Attackers are abandoning sustained, high-volume "giant" attacks in favor of rapid, low-intensity swarms. This shift challenges traditional detection models that rely on threshold-based triggers, as individual strikes often fall below alerting limits while collectively degrading service availability. The data also notes the decline of CLDAP vectors, suggesting attackers are refining their toolkits based on takedown pressures. For SREs, this environment demands a re-evaluation of monitoring strategies. You can no longer rely solely on absolute traffic spikes; instead, focus on anomaly detection for connection rate variability and protocol-level irregularities. Concrete takeaway: update your alerting rules to flag sustained low-level bursts rather than just peak bandwidth spikes to catch these distributed micro-attacks before they compound.
Cloudflare mitigated over 8,200 DDoS attacks per hour in Q3 2026 as attackers shifted to shorter, high-frequency strikes. Explore the latest threat data, including the collapse of CLDAP vectors and the impact of recent botnet takedowns.
— Cloudflare Blog