Architecture Home
Phase 1 - Discovery
01

Company Onboarding & Attack Surface Mapping

A customer enters their company name. The platform instantly begins mapping their entire digital attack surface, including domains, subdomains, cloud assets, and application endpoints, using 15+ specialized API sources.

15+API Sources
24hCache TTL
~30sSLD Discovery
recon-pipeline
$ Scan initiated for: Acme Corp [00:01] Querying crt.sh via residential proxy [00:03] Querying VirusTotal api.virustotal.com [00:04] Querying Shodan api.shodan.io [00:05] Querying Google CSE [00:06] Querying SecurityTrails, Censys, CIRCL [00:12] Found 47 SLDs [00:28] Found 1,284 subdomains [00:30] DNS resolution complete [00:30] ASN mapping: 12 networks identified
Phase 1 - Discovery
02

CDN / WAF / Origin Topology Mapping

The platform maps the full protection chain for every endpoint: which CDN fronts it, what WAF rules are active, where the load balancer sits, and whether the origin server is directly exposed. Misconfigurations at any layer become testable attack vectors.

12CDN Providers
8WAF Engines
Multi-LayerChain Analysis
CDN Layer: Cloudflare, CloudFront, Akamai, Fastly detected via CNAME + headers
WAF Layer: Imperva, F5, ModSecurity rules fingerprinted from responses
Load Balancer: ALB, NLB, HAProxy identified via headers and behavior
Origin Server: Direct IP exposure check, bypasses tested
Topology Complete: Full protection chain mapped, gaps identified
Phase 1 - Discovery
03

Multi-Region Availability Probing

Every discovered endpoint is probed from 15+ global locations using GlobalPing, testing ICMP, TCP, and HTTP availability. CDN-protected assets are identified and filtered to focus on real origin infrastructure.

15+Probe Regions
3Protocols
CDNAuto-Filter
US-East Singapore Brazil Iran Germany China
Phase 1 - Discovery
04

L7 Reconnaissance - 5 Protocol Deep-Dive

Five specialized tools fingerprint each live endpoint: HTTP stack analysis with uTLS, DNS security audit, SMTP hardening check, SIP service probing, and Direct-to-Router attack surface mapping.

5Recon Tools
uTLSFingerprinting
HTTP
TLS, Headers, WAF, Server ID
DNS
DNSSEC, Zone Xfer, Recursion
SMTP
SPF, DKIM, DMARC, Relay
SIP
OPTIONS, REGISTER, INVITE
Direct-to-Router
BGP exposure, traceroute analysis, router ACL gaps
Phase 1 - Discovery
05

Mobile & Desktop App Traffic Capture

Physical device labs intercept real application traffic. A jailbroken iPhone and Android tablet capture mobile API calls, while a Windows lab analyzes traffic from 44 desktop applications, discovering hidden endpoints invisible to web scanners.

2Mobile Devices
44Desktop Apps
MITMInterception
GET /api/v3/user/profile
200 application/json
POST /api/v3/feed/refresh
WS wss://live.acme.com/push
GET /api/v3/config/flags
403 /admin/internal
GET /api/v3/user/profile
200 application/json
POST /api/v3/feed/refresh
WS wss://live.acme.com/push
TLS 1.3 -> cdn.acme.com
gRPC backend.acme.com:443
UDP telemetry.acme.io:8125
QUIC edge.acme.com:443
MQTT iot.acme.com:8883
TLS 1.3 -> cdn.acme.com
gRPC backend.acme.com:443
UDP telemetry.acme.io:8125
Windows Desktop Lab
Slack wss://wss-primary.slack.com
Teams teams.microsoft.com
Zoom us04web.zoom.us/api
1Pass my.1password.com
Figma api.figma.com/v1
Notion api.notion.com
Slack wss://wss-primary.slack.com
Teams teams.microsoft.com
Phase 2 - Analysis
06

Traffic Baseline Capture - Know Your Normal

Before any testing, the platform captures the customer's real traffic patterns. Two methods: connect your CDN/WAF account (Cloudflare, AWS, etc.) for historical analytics, or add a lightweight JavaScript beacon to capture real user traffic. The baseline drives precise rate-limit thresholds, tuned to your actual traffic, not guesses.

APICDN Analytics
JSBeacon RUM
24/7Pattern Tracking
baseline-capture
$ Capturing baseline for acme.com [source] Cloudflare Zone Analytics: connected [source] JS Beacon: active (14 days of data) [data] Avg request rate: ~340 req/s [data] Peak (weekday 10AM): ~820 req/s [data] Weekend avg: ~180 req/s [data] Geographic: 62% US, 18% EU, 20% APAC [calc] Rate limit (weekday): 1,230 req/s (1.5x peak) [calc] Rate limit (weekend): 360 req/s (2x avg) [calc] Burst tolerance: 2,460 req/s (3x peak) [save] Baseline stored, seasonal tracking active
Phase 2 - Analysis
07

Dashboard Intelligence - Findings & Attack Vectors

All discovery results aggregate in the dashboard. The platform identifies protection gaps, maps the topology, and determines which attack vectors to test: L3/L4 volumetric, L7 application-layer, protocol-specific, and evasion techniques.

6OPI Categories
AutoVector Selection
12
Unprotected Endpoints
3
Missing DNSSEC
89%
CDN Coverage
7
Attack Vectors
No WAF
api.acme.com
TLS 1.0
legacy.acme.com
Phase 2 - Analysis
08

Initial OPI Score - Protection Baseline

The Open Protection Index (OPI) scores the company across 6 categories before any resilience testing. This becomes the "before" snapshot that hardening will improve.

42Initial OPI
Grade DRating
42
Open Protection Index
Defense Coverage
55
L7 Resilience
28
L3/L4 Resilience
60
Protocol Security
35
Operational
48
Evasion Resist.
25
Phase 3 - Resilience Testing
09

Bot Fleet Deployment - 19 Active Cloud Platforms

The Deploy Service provisions load generation instances across 19 active cloud platforms simultaneously (23 platform integrations total). Spot instances on 5 platforms reduce costs by 60-90%. Each bot auto-configures via boot.sh and registers with the Fleet Controller.

19Active Platforms
5Spot-Capable
~15sDeploy Time
AWS
GCP
Azure
Alibaba
Tencent
IBM
Oracle
DigitalOcean
Vultr
Linode
Hetzner
OVH
Scaleway
Kamatera
IONOS
UpCloud
Exoscale
Gcore
Cherry
Infomaniak
Latitude.sh
Civo
Contabo
Phase 3 - Resilience Testing
10

Coordinated Multi-Vector Resilience Test

The Fleet Controller dispatches coordinated test commands to the entire fleet. Multiple attack vectors run simultaneously, including volumetric floods, application-layer stress, protocol abuse, and evasion techniques, replicating real-world DDoS patterns.

7Attack Vectors
HTTP/2Fleet Protocol
1Fleet Controller
Fleet Controller: Dispatches multi-vector test plan to fleet
L3/L4 Volumetric: SYN flood, UDP amplification, ICMP flood
L7 Application: HTTP GET/POST flood, Slowloris, RUDY
Protocol Abuse: DNS amplification, NTP reflection
Evasion: Randomized headers, uTLS fingerprinting, IP rotation
Results streaming: Real-time metrics to dashboard via SSE
Phase 3 - Resilience Testing
11

Distributed Traffic - Dozens of ASNs & Geographies

Real-world attacks come from thousands of IPs across many networks. Single-source load testing is trivially filterable. DDactic generates traffic from 19 cloud providers across dozens of ASNs and geographic regions, making the test indistinguishable from a real distributed attack.

19Cloud Providers
30+ASNs
6Continents
US-East
EU-West
Singapore
Brazil
Australia
Japan
India
Germany
UK
Canada
S. Korea
S. Africa
Each region uses different ASNs, so traffic patterns match real distributed attacks, not single-source load tests
Phase 4 - Hardening & Verification
12

Automated Hardening Recommendations

Based on discovered vulnerabilities and test results, the platform generates vendor-specific CLI commands. 16 hardening templates across 6 vendors (Cloudflare, AWS, Azure, GCP, Akamai, Fastly) with optional credential injection for one-click deployment.

16Templates
6Vendors
Cloudflare - Rate Limiting
# Based on baseline: 340 req/s normal, 510 threshold curl -X POST \ "https://api.cloudflare.com/client/v4/zones/{zone}/rate_limits" \ -H "Authorization: Bearer {token}" \ -d '{ "threshold": 510, "period": 60, "action": { "mode": "challenge" }, "match": { "request": { "url": "*.acme.com/*" } } }'
AWS WAF - OWASP Rules
aws wafv2 update-web-acl \ --name "acme-protection" \ --scope REGIONAL \ --rules '[{ "Name": "AWSManagedRulesCommonRuleSet", "Priority": 1, "OverrideAction": {"None": {}} }]'
Phase 4 - Hardening & Verification
13

Apply & Re-Test - Verify Hardening

After the customer applies hardening (via CLI commands or manual configuration from the report), the bot fleet runs the same test battery again. The before/after comparison proves the hardening worked, and the improved OPI score demonstrates measurable security progress.

+46OPI Improvement
Grade ANew Rating
Before
42
Grade D - Significant Gaps
After
88
Grade A - Well Protected
Bonus - Industry Benchmarking
14

Compare Your Score Against Your Industry

DDactic scans entire industries using public data sources (19 sectors, hundreds of companies) to establish average security postures. Your fully-tested OPI score is compared against the industry baseline, showing exactly where you stand relative to competitors and what ROI your hardening investment delivered.

19Industries
Your OPIFull Assessment
Industry AvgIndustry Baseline
Your Company (Full Test)
88
Financial Industry Average
67
E-commerce Industry Average
51
+21 above financial avg · +37 above e-commerce avg · Hardening ROI: measurable
Continuous Protection
15

Continuous Monitoring & Seasonal Adaptation

DDoS resilience isn't a one-time test. Traffic patterns shift with seasons, product launches, and growth. DDactic continuously re-baselines traffic, adjusts rate-limit thresholds, and re-tests, ensuring protection evolves with the business.

24/7Monitoring
AutoRe-Baseline
AdaptiveThresholds
continuous-ops
[Jan] Baseline: 340 req/s → Threshold: 510 [Mar] Product launch detected: +180% traffic [Mar] Re-baseline: 952 req/s → Threshold: 1,428 [Jun] Seasonal dip: 280 req/s → Threshold: 420 [Nov] Black Friday prep: pre-scale to 3,000 [Nov] Re-test with 19-platform fleet: PASS [Dec] Post-peak normalize: 380 req/s → 570 OPI: 42 → 88 → 91 (continuous improvement)