5% of Nordic CISOs cited DDoS and opportunistic probing as their primary concern.

DDoS campaigns now combine 50+ attack vectors and adapt in real time.

Six-second pulse DDoS attacks eliminate the window for reactive intervention.

75% of network-layer DDoS attacks last less than one minute.

Technology, financial services, and gaming accounted for 34%, 20%, and 19% of DDoS attacks, respectively.

The United States accounted for 23% of application-layer DDoS attack representation.

Mexico and Brazil together accounted for 55% of observed DDoS attack activity.

Botnets leveraged more than 500,000 compromised systems to power DDoS campaigns.

Peak DDoS attack sizes increased by 262% year over year, with terabit-scale attacks occurring in seconds.

Network-layer attacks accounted for 82% of all observed DDoS incidents, a 20% increase from the previous report.

DDoS attack peak volume increased from 2.2 Tbps to 12 Tbps, a sixfold increase.

Total number of DDoS attacks increased to 1,300,000 in Q4 2025 from 512,000 in Q4 2024.

More than 90% of DDoS attacks last less than 10 minutes.

Distributed denial-of-service campaigns reached a peak of 31.4 Tbps.

64% of application-layer DDoS attacks exceed 10 minutes.

Over half of sub-1 Gbps DDoS attacks are under 200 Mbps and blend into normal traffic while probing defenses.

DDoS attacks surged by 150% year-on-year.

DDoS attack volumes reached 12 Tbps in Q4, representing a sixfold increase.

Layer 7 DDoS attacks surged 104% over the past two years.

Mexico, Brazil, and the United States accounted for 31%, 24%, and 20% of network-layer observed attack traffic, respectively.