Flagship case ยท Resilience & Security
Layered DDoS Defense Beyond the CDN
How Cloudflare and a separate application-behavior layer protected a live platform during a large DDoS attack.
Disclosure
The client is unnamed. Cloudflare absorbed volumetric traffic; the custom layer classified application behavior behind it. The case does not claim we replaced the CDN.
One-sentence outcome
A layered defense kept a live revenue-critical platform operating under DDoS pressure peaking at 300k RPS and 25+ Gbps.
Context and stakes
This was a live gaming platform during prime traffic windows, where downtime meant immediate commercial loss and eventual regulator questions. A degraded engineering vanity metric was the least of it.
Baseline and constraints
The incoming attack mimicked real user behavior at the application layer, while the inherited protection model consisted mostly of brittle rules created after previous incidents. There was no safe buffer for trial-and-error response.
Exact role
Chief Technology Officer owning the layered defense design, the incident response path, and the distinction between what the CDN absorbed and what the platform still had to classify itself.
Trigger to measured change
- Trigger
A production incident showed that generic edge rules were absorbing volume but not fully protecting business-logic behavior at the application layer.
- Constraint
The platform needed to stay reachable for real users while the defense separated hostile session behavior from legitimate traffic in real time.
- Decision
Use Cloudflare for the volumetric layer, then keep a custom Linux/BPF and agent-assisted application layer behind it, with uncertain classifications escalated to a human operator.
- Measured change
The combined stack handled attack conditions described in the claim ledger as 300k RPS and 25+ Gbps while preserving the layered provenance boundary.
300k RPS / 25+ Gbps - layered DDoS defense beyond the CDN.
Cloudflare performed its volumetric role; never imply bypass or ineffectiveness. The custom layer handled application behavior, and the approved owner statement remains attached to that detail in the evidence ledger.
- Context
- Anonymized live revenue-critical iGaming platform.
- Timeframe
- Incident and approved wording recorded in the phase-0 ledger on 2026-09-02.
- Baseline
- Cloudflare for volume, custom application-layer behavior behind it, with human escalation on low confidence.
- Role
- Chief Technology Officer owning the layered defense design, the incident response path, and the distinction between what the CDN absorbed and what the platform still had to classify itself.
- Source
- Review the source record
- Provenance
- Source post, master profile, and an approved owner statement.
- Confidence
- A - exact owner-approved wording plus first-hand scale evidence.
- Disclosure
- Anonymized case within the approved NDA-safe boundary.
Measured or observable result
Mitigated a production-scale DDoS attack targeting a live, revenue-critical platform, with traffic peaking at 300k RPS and 25+ Gbps. Cloudflare absorbed the volumetric layer; behind it, custom Linux/BPF filters used agentic AI to adapt defenses autonomously when confidence was high and escalated uncertain decisions to a human operator.
Attribution and caveat
Cloudflare performed its volumetric role; never imply bypass or ineffectiveness. The custom layer handled application behavior, and the approved owner statement remains attached to that detail in the evidence ledger.
Retained capability
The organization retained a defense model with explicit layer ownership instead of an ever-growing pile of post-incident rules that only described the last attack.
Related problem, next case, and CTA
The related case explains why infrastructure control mattered once the cloud's cost and network limits became visible.