Partners · Reseller

Resell DDoS resilience testing.

You own the client. DDactic executes the specialist DDoS component on your paper. 25-35% margin. White-label at Tier 2+. Four firm-type flavors below.

Partners › Reseller

Red teams, MSSPs, GRC consultancies and cyber insurers all share one gap: their clients' availability under DDoS has never been tested. Bug bounty programs exclude it. Red team SOWs de-scope it. MDR reacts to it. Insurance questionnaires skip past it. DDactic fills that gap as the specialist sub-contractor on your engagement.

101
Attack vectors
24
Cloud providers in fleet
6
Recon stages
47
Avg. assets / scan

Pick your firm type

The deal shape, margin, and process are the same. The framing you take to your client depends on how your firm already sells.

DDoS as a specialist sub for red teams

Every major red team SOW lists DDoS under "excluded activities." That gap is coverage your firm can now fill, with zero new technical capability on your side. You own the client. We own the DDoS component.

Why red teams and DDoS don't overlap

  • Different risk approval (NOC/edge team vs. the CISO's internal perimeter)
  • Different fleet: our cloud VMs across 24 providers vs. your implants and C2
  • Different window: minutes-long attacks vs. weeks-long engagements
  • Different stakeholder on the client side (CDN/WAF/edge team)
  • Different insurance and authorization paperwork

What we deliver under your brand

  • Global bot fleet orchestration across 24 providers
  • Volumetric and application-layer attacks, L3 through L7
  • CDN and WAF bypass technique testing
  • Per-host L7 behavioural fingerprint and hardening recommendations
  • Co-branded or white-label report, your logo on the output
Case study: read the MSSP engagement — the structure translates directly to a red-team sub-contract.

DDoS resilience testing for MSSP and MDR portfolios

Your clients ask about DDoS testing. You don't offer that. Now you do. DDactic runs under your brand, you own the relationship, we own the execution. No headcount added. 25-35% margin. DORA, NIS2, and ISO 27001 ready.

The scope gap your clients already feel

  • Bug bounty programs explicitly exclude DDoS. HackerOne, Bugcrowd, every major platform.
  • Red team engagements de-scope it on paper. Separate fleet, separate methodology.
  • Managed SIEM / MDR detects attacks in progress. It does not simulate them to validate the protection chain before the attack arrives.

What we deliver, white-labeled or co-branded

  • Six-stage passive recon, including subdomain discovery and port-scan
  • 101 vectors spanning L3, L4 and L7 (HTTP/2 Rapid Reset, QUIC/H3, amplification, application-layer)
  • 24-provider global bot fleet, geo-sourced to a realistic attack profile
  • Per-asset protection-chain fingerprint: CDN, WAF, ASN, architecture, bypass risk
Full case study: how an MSSP partner used DDactic to turn an availability question into pipeline →

Availability testing for compliance consultancies

"The regulation says 'test availability.' It does not say 'assume it works.'" DDactic delivers the DDoS simulation evidence your clients need to satisfy DORA, NIS2, ISO 27001 and PCI DSS availability requirements. One engagement, auditor-ready output.

Where availability testing is already mandatory

  • DORA Articles 24-25 — TLPT for in-scope EU financial entities. DDoS simulation qualifies as a TLPT component.
  • NIS2 Article 21 — Annex I entities must demonstrate defenses have been tested under realistic conditions, not just documented.
  • ISO 27001 A.17.1.3 — verify, review and evaluate continuity controls. A CDN that has never been stress-tested does not satisfy this.
  • PCI DSS v4 Req 12.3.4 — availability controls reviewed annually. QSAs increasingly ask for DDoS defense evidence for high-volume merchants.

What you hand the auditor

  • Framework-mapped evidence tags per finding (DORA / NIS2 / ISO / PCI)
  • OPI posture score, repeatable at renewal
  • Before/after hardening evidence when the engagement includes a retest

Pre-policy DDoS posture for cyber insurers

You price DDoS risk on every policy. You never test it. DDactic gives underwriters an objective DDoS posture score before the policy binds — and evidence of hardening at renewal.

The underwriting blind spot

  • Standard questionnaires cover vuln scans, phishing sims, EDR, MFA, patching, backups
  • DDoS posture is missing from most of them
  • "We have a CDN" does not mean the origin IP isn't directly reachable — we've found this at protection vendors' own infrastructure

What we deliver in 48 hours, passively

  • 0-100 OPI posture score, single index across six protection layers
  • Per-host protection chain — CDN, WAF, ASN, architecture — not assumed from a questionnaire
  • Typical findings: ~25 exposed origins, ~179 L7 vectors, directly floodable hosts
  • Entirely outside-in. No traffic to the insured's production environment.

How the deal shape works

Same mechanics across all four flavors. Margin, white-label and support scale by tier.

TierMarginRequirementWhite-label
Tier 125%1-4 active clients (rolling 12 months)Co-branded
Tier 230%5-9 active clients + quarterly business reviewFull white-label on reports
Tier 335%10+ active clients + joint go-to-market planFull white-label, custom integrations

New partners can ask about the Channel Design Partner program: your first three clients at 90% off Year 1 in exchange for feedback and a case study. See the full partner agreement for terms, deal registration (90-day protection), and payment schedule.

Register as a reseller

One form. We respond within one business day with the right flavor framing and a sample report in your target vertical.

Apply now Read the agreement

Reseller application

We respond within 24 hours. If you already know which flavor fits, say so in the message field.