NETSCOUT Expands Global DDoS Mitigation Capacity to 33 Tbps

Last Updated 3 hours ago by Kenya Engineer

Cybersecurity firm NETSCOUT is expanding its Arbor Cloud distributed denial-of-service mitigation infrastructure as organisations face increasingly large and complex internet-based attacks.

NETSCOUT has announced plans to double the mitigation capacity of its Arbor Cloud platform to 33 terabits per second, or Tbps, as part of efforts to strengthen the resilience of critical digital infrastructure against distributed denial-of-service attacks.

The expansion is expected to be completed by the end of August 2026 and will increase the platform’s ability to absorb and filter malicious traffic before it reaches customer networks.

Distributed denial-of-service, or DDoS, attacks involve overwhelming servers, networks or digital services with large volumes of traffic, making them inaccessible to legitimate users. Such attacks can disrupt financial services, healthcare systems, government platforms, retail operations and other services that depend on continuous internet availability.

NETSCOUT said the additional capacity will be distributed across Arbor Cloud’s 16 global traffic-scrubbing centres. These facilities analyse incoming traffic, separate legitimate requests from malicious activity and forward clean traffic to the affected organisation.

The investment follows NETSCOUT’s acquisition of additional DDoS-related network infrastructure, giving the company greater control over the systems used to deliver its cloud-based mitigation services.

Increasing scale of attacks

The expansion comes as cybersecurity researchers observe an increase in the size, frequency and complexity of DDoS incidents.

Attackers are increasingly using multi-vector techniques, in which several methods are deployed simultaneously against networks, applications and infrastructure. Some attacks are also designed as short, rapidly changing bursts that give defenders limited time to detect and respond.

Large botnets made up of compromised computers, routers, internet-connected cameras and other devices have further increased the amount of traffic attackers can direct towards a single target.

NETSCOUT cited emerging botnets such as Aisuru and Kimwolf as examples of networks capable of generating very large attacks. A small number of recent incidents have reportedly approached or exceeded 30 Tbps, placing pressure on traditional mitigation infrastructure.

Artificial intelligence is also expected to influence the threat landscape by enabling attackers to automate reconnaissance, adapt attack patterns and identify weaknesses more rapidly.

“With the increased use of AI, threat actors are targeting organisations whose defences are vulnerable to new and more complex DDoS attacks designed to take down critical infrastructure,” said Carlos Morales, senior vice-president and general manager of Arbor Cloud at NETSCOUT.

Morales said organisations increasingly dependent on cloud-native services and AI-powered applications will need automated and proactive defences to maintain service availability.

Hybrid protection model

Arbor Cloud forms part of NETSCOUT’s hybrid DDoS protection architecture, which combines on-premises detection and mitigation equipment with cloud-based traffic-scrubbing services.

Under this model, smaller attacks may be handled within an organisation’s local infrastructure, while large volumetric attacks are automatically redirected to cloud-based mitigation centres.

This approach is intended to stop attacks as close to their source as possible while ensuring that unusually large traffic volumes do not overwhelm an organisation’s internal network capacity.

NETSCOUT said the additional capacity will also allow the platform to manage attacks targeting several systems simultaneously, including so-called carpet-bombing attacks, where malicious traffic is distributed across multiple IP addresses or services.

The expanded network is expected to support faster stabilisation after major traffic spikes and reduce the risk of secondary disruption to connected infrastructure.

The service is supported by a round-the-clock security operations centre, which monitors attacks and assists organisations during mitigation and recovery.