01
Application layer (L7)
Heavy request scenarios against expensive pages such as search, login and checkout.
DDoS Resilience Testing
We find out whether your protection really works, with a permitted and controlled test, before an attacker tries it.
What it is
A DDoS attack can take your site or app offline for hours. Most companies use a CDN or firewall and assume they are protected, but the settings have never been tried. In a DDoS resilience test we review your protection, then send controlled test traffic within an agreed window and with the permission of your hosting and protection providers. That shows where you slow down and where the protection does not kick in.
What we cover
0602
Rate limiting
Whether rate limits and bot protection trigger at the right thresholds.
03
CDN and WAF settings
Whether the origin address is hidden, plus caching and firewall rules.
04
Infrastructure limits
At what load the servers, database and load balancer become the bottleneck.
05
Monitoring and alerts
How quickly an alert arrives once an attack starts.
06
Response plan
Whether who does what during an attack is written down and rehearsed.
How we work
- 01
Review
Architecture, CDN/WAF settings and origin exposure are reviewed.
- 02
Permission and planning
We coordinate with your hosting and protection providers and agree the window and stop conditions in writing.
- 03
Controlled test
Traffic is increased step by step and systems are watched live; the test can be stopped at once.
- 04
Report
Bottlenecks, protections that did not trigger and recommended settings are reported.
- 05
Fix and retest
Once the settings are fixed, the test is repeated.
What you get
- A review report of your protection settings
- Response times and bottlenecks measured during the test
- Recommended settings for CDN, WAF, rate limiting and infrastructure
- Response steps for an attack
When you need it
- Before a campaign, ticket sale or peak season
- If your e-commerce, booking or payment systems cannot afford downtime
- After moving to a new DDoS protection service, to confirm it works
- If you have had outages from attacks or unexpected traffic before
Methodologies & Standards
NIST SP 800-189OWASP Automated ThreatsCIS Controls v8Rate limitingWAF / CDN
Frequently Asked
Only with the written permission of the system owner and within the rules of the hosting and protection providers. We do not start a test without these permissions, and traffic is sent only to your own systems.
The test is done step by step and watched live, and it stops at thresholds agreed in advance. If you prefer, we test a copy of the live system or run it at your quietest hours.
Usually, yes. If the origin address is exposed, an attacker can bypass the CDN, and rate limiting and caching are often left at their defaults. The point of the test is to see that these settings really work.
Related industries
More services in Cybersecurity
All ofCybersecurity- Penetration TestingWe find the gaps in your web, mobile, API and network before an attacker does.
- Source Code ReviewWe find vulnerabilities in the code itself, while it is still being written.
- Wireless (Wi-Fi) Security TestingWe test how exposed your office and guest Wi-Fi are to someone sitting in the car park.
- Phishing SimulationWe send your staff realistic fake e-mails, then raise awareness with short training.
- Active Directory and Internal Network TestingWe show how quickly an attacker inside your network could get from one laptop to the whole company.
- Cloud Security ReviewWe find public storage, excessive permissions and risky settings in your cloud accounts before an attacker does.
