Speaker: Lukáš Kos
Beyond Hardware:
Why Your DDoS Protection Can Fail Before Reaching Your Datacenter
Last Thursday, we presented at the ITSW conference in Prague on a critical topic: the evolution of volumetric DDoS attacks. While these attacks used to be rare, current data shows they are becoming increasingly frequent and more powerful. However, the risk of upstream saturation is often underestimated.
The Threat in Numbers: Records No One Wants to Break
According to ENISA (European Union Agency for Cybersecurity) Threat Landscape 2024, DDoS attacks accounted for 41.1% of reported incidents. In 2025, this share increased to an alarming 81.4%.
But it’s not just about frequency—it’s mainly about scale. In April last year, we were discussing attacks reaching 6.5 Tbps. By October, the global record had climbed to 29.5 Tbps. The world record was broken five times in a single year.
In the Czech Republic, the unfortunate record is held by the 2022 attack on O2, exceeding 200 Gbps. WEDOS infrastructure faced a peak of 190 Gbps in the same year. These experiences directly led to the development of WEDOS Global Protection (WGP).
Critical Point of Failure: Upstream Saturation
Many companies invest millions in top-tier on-premise solutions. These devices are excellent at traffic scrubbing—but they have one critical weakness: upstream saturation.
If an attacker floods your connection with a massive volume of traffic (a volumetric attack), the traffic never even reaches your firewall. The link becomes congested before your hardware has a chance to filter anything.
WGP addresses this issue through a global Anycast network with more than 120 PoPs (Points of Presence) and 3,000 servers. A shared IP architecture distributes large-scale attacks into smaller fragments and filters them close to the source, protecting your connectivity.
Common Misconceptions About Protection
“My hosting provider will protect me”
Hosting providers protect their infrastructure against common attacks. However, targeted, state-sponsored, or large-scale hacktivist campaigns using botnets go far beyond standard hosting-level protection.
“I need to replace my existing hardware”
WGP can be easily deployed in front of your existing infrastructure. It can even filter only the L3/L4 layer, allowing “clean” traffic to be further analyzed by your internal L7 systems.
“I must host with WEDOS to use this”
WGP is a standalone service. Your hosting and domains can be anywhere in the world—you can still benefit from our protection.
European Sovereignty and Data Security
Unlike 90% of Anycast-based competitors, WEDOS is a purely European company. This means:
- No US Cloud Act exposure: Your data is not subject to US data access laws
- Full compliance with NIS2 and GDPR
- Decryption only within the EU:
For politically or strategically sensitive data, it is unacceptable for decryption and analysis to occur outside EU jurisdiction. WGP guarantees that these processes take place exclusively within the European Union.
Final Recommendations for IT Management
Evaluate the resilience of your solution:
- How is the risk of upstream saturation handled?
- What is your certified DRS (DDoS Resiliency Score)?
WGP currently holds a 5/5 rating from ZeroBS and is moving toward Level 6 after upgrades - Where do your encrypted data physically terminate, and under which jurisdiction?
Infrastructure is not just about performance—it’s about sovereignty and resilience. These cannot be safely outsourced outside the EU without introducing security risks.
