Cloudflare’s Q3 DDoS report puts short-burst response time in focus

What Changed

For July–September 2026, Cloudflare reports mitigating 18.2 million network-layer DDoS attacks, up 208% from Q3 2025. It says 96% ended within ten minutes and 98% stayed below 1 Gbps. Attacks above 1 Tbps fell from 805 in Q2 to 251 in Q3. These are different comparisons: annual growth in total count versus a quarterly decline in the largest category. [1]

Why It Matters

Analysis A short disruption can finish before a manual escalation produces a decision. The useful operational question is how much customer impact occurs between the first abnormal traffic and an effective response. A peak-bandwidth chart alone cannot answer it.

In an authorized exercise, measure detection, enforcement and recovery separately, then compare those times with the service’s tolerance for interruption. Check whether dashboards retain enough detail to investigate a brief event after it ends. Review false positives too: an aggressive rule that blocks ordinary users can create the same visible symptom as the attack it is intended to stop. Keep capacity planning for large floods, while giving frequent smaller disruptions their own tests, owners and success criteria. These recommendations depend on the service’s architecture and existing protection; the report does not establish one universal threshold.

Evidence & Uncertainty

The evidence is Cloudflare network telemetry, not a census of all attacks or a prediction for a particular organization. Its duration and bandwidth percentages are separate distributions, not a stated combined share. BriefSpire has not independently reproduced the dataset. Priority: Important reflects preparedness value; the report does not establish an active incident at the reader’s organization.