You scope DDoS out because it is loud, risky, and off your core skill tree. Your client still gets hit. DDactic is the white-label availability layer you add to an existing engagement: modern L3/L4 and L7 vectors, automated evasion, and executable remediation, delivered under your brand at partner pricing.
Full-scope red teams and intelligence-led frameworks (TIBER-EU, CBEST, iCAST) are meant to cover availability. In practice most teams skip the volumetric layer. Three reasons:
Hitting a live edge with real volume needs an isolated harness, kill switches, and a tested rules-of-engagement flow. Most teams would rather not touch it.
A single host and an old script top out well below what a modern botnet delivers. You cannot honestly test a CDN or scrubbing tier at 2 Gbps.
QUIC and HTTP/3 floods, L7 cache-bypass, WAF evasion, and API exhaustion move fast. Keeping a bespoke DDoS capability current is a product on its own.
The same engagement, with a real availability workstream instead of a footnote.
Sophisticated red teams push back on "one host" - and they are right to. Here is what the alternatives actually produce and where each breaks down.
Distributing hping3 or GoldenEye across 20-50 VPS nodes via Ansible is cheap and fast. The problem: every major VPS provider's ASN (Hetzner AS24940, Vultr AS20473, DigitalOcean AS14061) is on public Cloudflare WAF blocklists. One WAF rule drops the entire fleet before a single packet reaches the scrubbing tier. The CDN does not blink.
AWS requires a Simulated Events form and routes tests through an authorized AWS Partner only. GCP and Azure have equivalent approval processes. Without approval it is a ToS violation. With approval the process takes days to weeks and the engagement timeline is gone. AWS AS16509, GCP AS15169, and Azure AS8075 are blocked at CDN WAF layer regardless.
Illegal under CFAA when used against third-party infrastructure, even with client authorization. Operation PowerOFF took 27 platforms offline in December 2024. The few services claiming legitimacy cannot produce carrier-grade volume and generate zero SOW-able output: no chain of custody, no kill switches, no rules-of-engagement documentation.
Academic frameworks like DDoSim run bots as VMs on a single LAN. No geographic distribution, no diverse ASN coverage, no modern L7 vectors. Suitable for dataset generation and lab research. Cannot reach the thresholds where a CDN or scrubbing center mitigation actually activates.
DDactic traffic originates from a distributed fleet across 24 providers spanning diverse ASNs including non-datacenter ranges that CDN WAF rules do not block. Every test runs under a documented rules-of-engagement flow with staged ramps and hard kill switches - fully SOW-able output with a clean chain of custody.
Some engagements want a clean fixed-scope deliverable. Others fold availability into a bespoke adversary simulation. We price both off one catalog so your quote reconciles either way.
The difference between a footnote and a workstream a client can act on.
| Capability | Typical in-house DDoS | DDactic plugged in |
|---|---|---|
| Volumetric ceiling | One host, low Gbps | Distributed traffic generation, scaled per target |
| L7 evasion | Basic HTTP flood | Automated WAF evasion, cache bypass, adaptive patterns |
| QUIC / HTTP/3 | No | Yes, current transport-layer vectors |
| Scrubbing / CDN tier test | Cannot reach threshold | Tests above cloud baseline to exercise mitigation |
| Production safety | Ad hoc | Lab-isolated, staged ramps, kill switches, RoE flow |
| Remediation output | Narrative findings | CLI hardening scripts plus IR playbook |
| Report | Your template | White-label, drops into your report |
Buy off list at your channel discount and bill your client at whatever you choose, inside your existing SOW or as a standalone line. Volume is measured in active client engagements per rolling twelve months.
Your first three client engagements are priced at design-partner rates (90% off year one, 50% off year two), so you can prove the workstream at almost no cost. From year two your standard volume tier applies. In exchange: a quarterly product and go-to-market feedback session, a DDactic listing on your vendor page, and one anonymized case study after the first engagement goes live.
Margin example: a $7,500 Full Assessment at Tier 1 costs you $5,625; bill it at list and keep $1,875, or fold it into a larger adversary-simulation SOW at your own rate. At Tier 3 the same assessment costs you $4,875.
Book a 30-minute technical walkthrough. We run a sample scope on a target you choose and show you the harness, the vectors, and the remediation output before you commit anything.