Between August 20–21, 2026, a cybersecurity professional posted a thread on Mastodon describing years of DDoS penetration testing. Key findings: most defenses target HTTP/1.1, application-layer attacks have HTTP/2 equivalents, vendors detect attacker IPs within minutes, and no vendor provides comparable metrics.
No BS check run yet — press ⚖ to extract this story's claims and verify them against independent sources.
במשך כמה שנים ניהלתי בדיקות DDoS. בדקנו סביבות שונות של יצרני הגנות, ועזרתי לחברות להקשיח את תצורת ההגנה והארכיטקטורה שלהן. # cybersecurity # ddos # infosec ddactic.net?ref=mastodon
For a few years I ran DDoS tests. Different vendor environments, different architectures. I would help companies understand their attack surface and tune their defenses. # cybersecurity # ddos # infosec ddactic.net?ref=mastodon
Every major application-layer attack class has an HTTP version equivalent. Most defenses are written for HTTP/1.1. The gap is not theoretical. # cybersecurity # ddos # infosec ddactic.net?ref=mastodon
$1.08 billion. # cybersecurity # ddos # infosec ddactic.net?ref=mastodon
We don't just scan individual companies. We scan entire industries. # cybersecurity # ddos # infosec ddactic.net?ref=mastodon
Most security tools tell you what's wrong. We generate the exact commands to fix it. # cybersecurity # ddos # infosec ddactic.net?ref=mastodon
I built a production-ready cybersecurity SaaS platform in 60 days. # cybersecurity # ddos # infosec ddactic.net?ref=mastodon
We scan companies and almost always find the same thing in the subdomain list: # cybersecurity # ddos # infosec ddactic.net?ref=mastodon
Every TLS certificate you've ever issued is public. # cybersecurity # ddos # infosec ddactic.net?ref=mastodon
A scrubbing center is not a guarantee. It's a routing decision, and most CISOs blur three different things into one. # cybersecurity # ddos # infosec ddactic.net?ref=mastodon
Hot take: "I built this with AI" is usually the wrong message. # cybersecurity # ddos # infosec ddactic.net?ref=mastodon
We don't rely on a single source for asset discovery. # cybersecurity # ddos # infosec ddactic.net?ref=mastodon
We use Claude Haiku at four specific points across our six-stage recon pipeline. Not for marketing. For accuracy. # cybersecurity # ddos # infosec ddactic.net?ref=mastodon
We added breach database lookups to our recon pipeline. # cybersecurity # ddos # infosec ddactic.net?ref=mastodon
Our full distributed load generation fleet costs $23.50 per hour. # cybersecurity # ddos # infosec ddactic.net?ref=mastodon
Every instance in our fleet runs up to 7 testing tools simultaneously. Each one can crash. # cybersecurity # ddos # infosec ddactic.net?ref=mastodon
DDoS vendors detect and block attacker IPs within minutes. Static IPs become useless fast. # cybersecurity # ddos # infosec ddactic.net?ref=mastodon
Every vendor has a different way to tell you you're "protected." None of them give you a number you can compare across vendors, track over time, or use to justify budget. # cybersecurity # ddos # infosec ddactic.net?ref=mastodon