PENTESTY · EDITORIAL ANALYSIS · · 4 min read
DDoS: traffic was mitigated, but did the service remain usable?
A provider’s global percentage does not determine your company’s exposure. Acceptance needs to connect observed traffic to the service outcome that matters.
By Pentesty
The metric has a defined period and observer
In Cloudflare’s H1 2026 report, Brazil appears as the source of 21.4% of mitigated DDoS request traffic in the second quarter. The report covers the first half and includes that quarterly breakdown. This is the provider’s observation, not a census of attacks in Brazil. Traffic source location does not identify who directed a campaign.
Compare questions before comparing numbers
A percentage may count requests, events or data volume. One period may be a quarter while another covers six months. Record the denominator and network observation point used to calculate the metric. Without that correspondence, variation may reflect measurement differences rather than a change in the company’s exposure.
Use the statistic to ask which assets are covered, which path receives mitigation and which dependencies remain outside it. Our decision-quality and loss-estimate analysis complements this discipline. A published number does not replace inventory or establish the likely loss for a particular service.
Choose a journey representing availability
Imagine an application allowing order lookup and confirmation submission. Its edge responds, but the lookup depends on DNS, authentication and a third-party integration. Define the expected outcome with process owners and observe each handoff using test accounts and information.
Record what constitutes completion, the agreed time allowance and errors invalidating the result. An accessible homepage may coexist with an unavailable essential function. Distinguish the network response, application response and confirmation received by the user before concluding that operation was preserved.
Connect measurement to the contract and actual path
Start with configuration and record review plus a tabletop exercise. Any load assessment needs separate planning with operators and the provider, boundaries and stop conditions. This proposal calls for no DDoS traffic generation, reflector use or testing against shared infrastructure.
- Coverage: connect domain, service, route and dependencies to contracted protection. Record activation conditions and components depending on another team.
- Observation: connect mitigation telemetry timestamps to legitimate check outcomes and retain the metric’s units, aggregation and limitations.
- Routing: simulate fictional degradation and follow who receives, authorizes and confirms handling, including loss of the ordinary support channel.
- Acceptance: check the selected journey’s outcome and outstanding work. Discarded traffic totals and closed tickets each need their own context.
The conclusion should survive a supplier change
Our cloud recovery review helps identify dependencies also supporting the alternative path. For DDoS, add who observes incoming traffic and who confirms the business function. Evidence should let another person understand that division without depending on a single dashboard.
After a route, application, authentication or supplier change, repeat the comparison within the agreed scope. Retain the assessed service, sample, timestamps and limitations. The useful result is a decision about observed availability and outstanding actions without turning a geographic statistic into attribution or a protection guarantee.
Frequently asked questions
Does 21.4% represent every attack in Brazil?
The cited number is a mitigated-request-traffic breakdown in Cloudflare’s report. It is neither a national census nor a company’s probability of experiencing an attack.
Does source country identify the operators?
Observed traffic origin does not determine attribution. Devices and intermediary services may participate; attribution needs its own evidence and additional context.
Does blocked traffic prove that the application worked?
Check the legitimate journey’s outcome and relevant dependencies. Mitigation telemetry answers a different question and should be connected to observed timing and scope.
Must we generate an attack to start reviewing?
Start with inventory, contract, configuration, records and escalation routing. A load test requires separate planning and authorization involving operators and the provider.
Sources and references
Original Pentesty analysis, published October 16, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.