Don't build a Maginot line for DDoS - why a single-layer defense is a fatal strategy

The Maginot Line was a genuine masterpiece. Hundreds of kilometers of interconnected fortifications, artillery casemates, and underground railways, built at enormous cost along France’s eastern border. On the sectors it covered, it was never breached. Not once.

German forces went through the Ardennes. Fast, flanking, across a front the Line was never designed to cover. Six weeks later, the French defense fell. 

The engineering was excellent. The defense strategy was fatally wrong.

If your DDoS defense is built around diverting traffic to an external scrubbing center and waiting for clean traffic to return, you have built yourself a Maginot Line. 

Cloud-based scrubbing works, and works well. But - it was designed for attacks that were slow enough to reroute and narrow enough to funnel. 

Those assumptions no longer hold.

The Blitzkrieg arrived

The Nokia Threat Intelligence Report 2025 documents a DDoS attack landscape that evolved across every dimension at once. Terabit-scale attacks are now a daily occurrence for many telecommunications providers, up from once every five days in 2024, with peaks commonly reaching 5-10 Tbps and beyond. 

Over 100 million compromised residential endpoints, roughly 4% of the world’s home internet connections, stand ready as botnet infantry. And then, Kimwolf arrived: two million hijacked Android devices, a record-setting 33 Tbps attack, randomized bursts lasting a minute or two. Hit and run at a continental scale.

Then, there is the tempo. Bite Latvija, a European operator featured in the report, blocked nearly 4,000 DDoS events in a single year. Sixty-nine percent of them were multi-vector attacks. Peak intensity 280 Gbps. Average duration under fifteen minutes. 

And all that was before Kimwolf and its generation of botnets came to dominate the landscape. Today, 78% of all DDoS attacks conclude in under five minutes. More than a third finish in under two. Your SecOps engineer cannot get a coffee and be back before the attack is over.

The Blitzkrieg was faster, wider, and aimed at the sectors the Line left uncovered. Size was never the issue.

Where the DDoS defense line breaks

Speed: the reinforcements arrive after the battle. On-demand cloud scrubbing requires traffic diversion via BGP rerouting. That process takes minutes. Most attacks take less. You are mobilizing a defense for an attack that already ended, or one that already served its purpose as a diversion for something deeper.

Scale: you cannot divert the whole front. Carpet-bomb DDoS can hit hundreds of destination prefixes simultaneously. You cannot reroute them all. Eighty-two percent of DDoS floods stay below 50 Gbps: individually modest, collectively relentless. Centralized rerouting was never built for a front that wide. The attack goes where your diversion is not. The Ardennes, every time.

Sovereignty: you have given away your map. When all traffic routes through an external provider, you lose first-packet visibility into your own network. No baselines. No sub-threshold anomaly detection. No view of the secondary intrusion hiding behind the volumetric flood, the kind Salt Typhoon made painfully visible. Sixty-three percent of operators faced “living off the land” attacks last year; 55% reported threats tailored to telecom infrastructure. Under NIS2 and DORA, that outsourced dependency is itself a compliance risk. You cannot defend what you cannot see.

What France actually needed (and what your DDoS defense needs, too)

The Maginot Line could have stayed. France needed to add what was missing: mobile forces, distributed detection, and response at the point of contact.

Network-embedded detection, analysis of flow telemetry, and packet samples at the network edge give you back your map. Detection in seconds. Automated mitigation via NETCONF/FlowSpec and ACLs on your own routers gives you the mobile divisions France never had. 

Cloud scrubbing can stay for genuine emergencies, the events that exceed what any single network can absorb. Your network handles the daily barrage. The cloud handles the rest.

Cloud-based DDoS protection has a place. The Maginot error is treating one impressive system as a complete strategy.

Audit your time-to-detect. If that number involves waiting for an external provider to activate, you have a gap. Quantify it. Make network-embedded detection your primary layer. Reposition the cloud-based defense as an overflow. 

This is the approach behind Deepfield Defender, upon which more than 50 operators worldwide already depend to defend their infrastructure, collectively protecting hundreds of terabits per second of live traffic around the clock.

The Maginot Line still stands in Alsace. You can visit it. A monument to the principle that the best defense in the world fails when it is the only one you have.

Your DDoS protection should not be a monument. 

Build it as a living defense.