A six-week DDoS resilience assessment uncovered 12 critical attack vectors, an F5 appliance with ASM disabled, and no ISP scrubbing on the highest-traffic segments. OPI score moved from 38 to 71.
The client is a mid-market Managed Security Services Provider that operates security operations and infrastructure on behalf of 40+ enterprise customers in finance and healthcare. Their own perimeter - the portals, APIs, and management interfaces their customers connect to - had never been tested for DDoS resilience.
The CISO knew that standard vulnerability assessments skip availability attacks entirely. The question wasn't whether there were gaps, it was how exposed they actually were. They engaged DDactic after a competitor's platform experienced a multi-hour outage during a client demo caused by a low-rate HTTP flood that bypassed rate limits.
"Our red team covers intrusion. Our pen testers cover OWASP. Nobody had ever tested what happens when someone just tries to make our platform unavailable. DDoS was the one thing everyone assumed someone else was handling."
CISO, anonymized MSSPThe engagement ran in four phases over six weeks. All active testing was conducted against non-production assets first, with production simulation approved in writing before any traffic was generated.
DDactic's automated scan and questionnaire-driven analysis surfaced gaps that standard vulnerability assessment would not have found, because they are not vulnerabilities in the CVE sense - they are configuration choices that work fine against intrusion attempts but collapse under volumetric or application-layer flood conditions.
client_header_timeout (60s) allows slow-connection attacks to hold threads open for the full timeout window. Connection pool exhaustion in 3 minutes under sim conditions.The DDactic OPI (Operational Protection Index) measures DDoS resilience across six dimensions: CDN coverage, L7 protection depth, L3/L4 scrubbing, origin shielding, OS-level controls, and response readiness. An OPI of 38 (grade F) means most volumetric and application-layer vectors go unmitigated. An OPI of 71 (grade C) means the highest-probability attack paths have been addressed and the remaining gaps are documented and scheduled.
"The gap report showed us exactly what to fix and in what order. We knew about Cloudflare but we didn't know the origin was reachable. That finding alone justified the whole engagement."
Network Security Lead, anonymized MSSPA DDactic passive scan takes 48 hours and shows your CDN coverage, direct-origin exposure, and protection layer gaps - no traffic generated, no agent installed.