The most consistent finding across 2026 assessments is not a specific vulnerability -- it is a structural gap between what organizations believe their defenses do and what those defenses actually do under measured load. Scrubbing capacity is quoted in Gbps but rarely translated to requests-per-second per endpoint. WAF rate rules exist in configuration but have not been tested at production traffic volumes. This gap between stated posture and measured posture is the central theme of every assessment cycle.
OPI Score Distribution
Across assessments completed through Q2 2026, the median OPI (Open Protection Index) score is 41 out of 100. Scores cluster in two ranges: 25-45 (organizations with perimeter protection and some WAF configuration, but no layer-7 rate controls or endpoint-level testing) and 65-80 (organizations with active rate limiting, tested playbooks, and measurable endpoint capacity). Fewer than 10% of assessments produce scores above 80, and those uniformly share one characteristic: they have run their own load tests against production endpoints and know the exact threshold at which response time degrades.
What OPI measures
OPI scores six categories: perimeter coverage (0-20), layer-7 rate controls (0-20), endpoint capacity measurement (0-15), TLS hardening (0-15), authentication surface protection (0-15), and incident response readiness (0-15). A score of 41 typically reflects full perimeter coverage with partial WAF configuration but no capacity measurement and no tested playbook.
The Most Common Gaps
Three gaps appear in more than 70% of assessments. First: rate limiting scoped to IP rather than endpoint. An IP-based rule that allows 1,000 requests per minute per source IP provides no protection against a distributed attack with 10,000 source IPs each sending 100 requests per minute. The effective rate at the endpoint is 1,000,000 requests per minute with no rule triggered. Second: authentication endpoints unprotected by rate limiting. Login, password reset, and OAuth token endpoints appear in the critical finding category in the majority of assessments because the per-endpoint cost of these requests (bcrypt hashing, session creation, database writes) makes them disproportionately expensive to serve under load. Third: no documented capacity threshold for any endpoint. Organizations cannot state, even approximately, the request rate at which their most critical endpoints degrade. This means they cannot set rate limits at a meaningful threshold and cannot measure whether an attack is succeeding.
Sector Patterns
Financial services organizations score higher on perimeter coverage (Cloudflare or Akamai enterprise contracts are nearly universal) but lower on endpoint capacity measurement. The presence of a scrubbing contract creates a false sense of completeness: the organization believes the coverage is handled, and no one has tested whether the application layer is actually protected. Healthcare organizations show the inverse pattern -- less perimeter coverage but more awareness of specific endpoint risks because outage events in healthcare have direct operational consequences that force incident response planning. Technology companies score highest overall, primarily because engineering teams have more direct access to production metrics and are more likely to have run load tests.
What Changes After Assessment
The 30-day remediation cycle shows consistent improvement on the measurable gaps. Rate limiting on authentication endpoints is the most common first action, and it is also the highest-impact: organizations that add per-endpoint rate limiting to login and password-reset paths see their authentication surface OPI sub-score improve by an average of 9 points. TLS renegotiation disable is the second most common action because it requires a single configuration change with no traffic impact and removes a known amplification vector. Capacity measurement -- actually running load tests to establish endpoint thresholds -- is the most deferred action despite being the most foundational, because it requires engineering time and production access that security teams cannot unilaterally schedule.
The measurement gap is not a tooling problem
Most organizations have load testing infrastructure available. The blocker is organizational: security teams cannot schedule production load tests without engineering involvement, and engineering teams do not prioritize security-motivated load tests against already-deployed infrastructure. Assessment findings that require cross-team coordination resolve more slowly than findings that a single team can implement.
Looking at the Full Population
The population of 2026 assessments reflects organizations that have taken a proactive step -- they commissioned an assessment -- so the distribution is biased toward higher security maturity than the broader enterprise population. Even within this self-selected group, fewer than 10% have measured their endpoint capacity and fewer than 30% have a tested DDoS incident playbook. The unmeasured population is almost certainly lower. The data suggests that the majority of enterprise organizations are operating with DDoS protection that has been purchased but not validated, configured but not tested, and documented but not practiced.
See Where Your Organization Falls
DDactic produces an OPI score for your specific environment -- perimeter coverage, endpoint rate controls, TLS posture, authentication surface, and incident readiness -- with prioritized findings for each gap.
Run a Free Scan