Carlos Morales, SVP and GM – Arbor Cloud DDoS Mitigation, Netscout, Inc.
Security teams are increasingly entrusting fully automated defenses for DDoS mitigation. The logic is that only machines can handle the hyper-volumetric, multi-vector attacks that often test defenses through pulses and waves.
That logic is sound, given the rapid movement of AI-based attacks and the lack of expertise available to companies for defense. The International Information System Security Certification Consortium (ISC2) puts the global workforce gap at almost 5.5 million people. So, it is no surprise that AI adoption in cybersecurity climbed from roughly half of organizations to nearly 80 percent in a single year, even though only about a quarter call their deployment mature.
Exclusively relying on AI-based automation for defense represents an over-rotation of defensive posture. Greater autonomy carries its own risk. It is well established that AI is not perfect in its analysis. Incorrect conclusions and hallucinations are common and can result in aggressive false positives that block legitimate, revenue-generating traffic and are difficult to troubleshoot and correct.
Human judgment plays, and must continue to play, a pivotal role in DDoS mitigation.
How Attacks Actually Unfold
The experience of a tier-one financial institution hit by a massive 3-terabyte attack illustrates how modern DDoS protection has evolved to protect against larger, more complex attacks.
Over the last two years, AI has enabled the creation of mega botnets with access to hundreds of thousands and even millions of machines. Attackers used to rely on reflection and amplification techniques to reach big numbers, bouncing forged requests off public internet services. But those techniques generated traffic that hit a limited and predictable set of IP protocols and ports, meaning defenders could easily block the attack.
Gone is that predictability.
Now, it is replaced by real traffic from real machines that tie up traffic at the expensive application layer. Mega botnets also provide a means for attackers to conduct more consistent reconnaissance on targets and to carry out smaller, more targeted attacks simultaneously against multiple victims. This shift toward more intelligent and tailored attacks makes it more difficult to identify which vectors to drop and creates more possibilities for AI automation to get it wrong.
The aforementioned 3-terabyte attack evolved continuously, from multiple vectors, with shifting techniques and waves of traffic. Those tactics are designed to probe defenses and evade detection. Attackers also tend to initiate attacks in short bursts to avoid time-based detection thresholds.
Speed, volume and rapidly shifting vectors are why a base of automation is required, while complexity and risk are the factors that demand human intervention.
A couple of examples illustrate the balance security professionals need to strike:
Sometimes, The Attack That Isn’t The Attack
In research conducted with IDC, the concern security professionals raised most often was not attack volume or velocity. It was that DDoS is frequently a smokescreen. It serves as a cover for data theft, lateral movement or extortion elsewhere while the SOC watches the flood.
This is where the automation case and the human case stop competing. Automating the flood response is precisely what frees human analysts to ask the larger questions.
The Outage You Cause Yourself
Systems tuned for speed and scale can produce false positives, and a mitigation decision made without enough evidence cannot reliably distinguish an attack surge from a flash sale, a product launch or a breaking-news traffic spike. Block the wrong flow at the wrong hour, and the business takes itself offline at the exact moment it most needs to be up and running.
The Mandate For Humans In The Loop
At any large institution or organization, even partial outages can cause significant financial damage and anger customers who lose access to their accounts.
Fortunately, the tier-one financial firm mentioned above had prepared for this exact scenario. Layered defenses were overseen by a partner-led, security operations team with the experience and expertise to manage complex attacks. The SOC continuously analyzed data from the automated solutions and adjusted as necessary to ensure the mitigation remained effective.
The industry paradox is that the complexity and speed of this new breed of attack, combined with the scarcity of security talent, are leading some organizations to solely rely on AI automation.
That decision could cost them dearly.
Embedding trained professionals at high-risk decision points ensures that mitigation actions are weighed against corporate risk tolerance and compliance mandates. Human experts contextualize anomalies, preventing machine-led responses from inadvertently causing costly, self-inflicted outages. Ultimately, integrating human accountability with automated speed provides organizations with a resilient security posture that protects both infrastructure and the bottom line.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?