DDoS Statistics

5% of Nordic CISOs cited DDoS and opportunistic probing as their primary concern.

Peak DDoS attack sizes increased by 262% year over year, with terabit-scale attacks occurring in seconds.

More than 90% of DDoS attacks last less than 10 minutes.

DDoS campaigns now combine 50+ attack vectors and adapt in real time.

Six-second pulse DDoS attacks eliminate the window for reactive intervention.

Over half of sub-1 Gbps DDoS attacks are under 200 Mbps and blend into normal traffic while probing defenses.

Botnets leveraged more than 500,000 compromised systems to power DDoS campaigns.

Distributed denial-of-service campaigns reached a peak of 31.4 Tbps.

DDoS attack volumes reached 12 Tbps in Q4, representing a sixfold increase.

Mexico, Brazil, and the United States accounted for 31%, 24%, and 20% of network-layer observed attack traffic, respectively.

64% of application-layer DDoS attacks exceed 10 minutes.

Total number of DDoS attacks increased to 1,300,000 in Q4 2025 from 512,000 in Q4 2024.

DDoS attacks surged by 150% year-on-year.

DDoS attack peak volume increased from 2.2 Tbps to 12 Tbps, a sixfold increase.

Network-layer attacks accounted for 82% of all observed DDoS incidents, a 20% increase from the previous report.

75% of network-layer DDoS attacks last less than one minute.

Only 2% of network-layer DDoS attacks extend beyond ten minutes.

The United States accounted for 23% of application-layer DDoS attack representation.

Technology, financial services, and gaming accounted for 34%, 20%, and 19% of DDoS attacks, respectively.

Mexico and Brazil together accounted for 55% of observed DDoS attack activity.

Telecoms accounts for just 24% DDoS attacks in 2025, down from 42% in 2024.

Government’s share of total attacks increased from 5% to 12% year-over-year, with an average attack size of 5.5 Gbps.

Layer 7 DDoS attacks surged 104% over the past two years.

Manufacturing experienced an average attack size of 11.6 Gbps, the largest across all industries.

The average DDoS attack size increased almost 70% from the year prior.

The average DDoS attack duration decreased to 20 minutes, down from 39 minutes the previous year.

89% of DDoS attacks now conclude in under 10 minutes.

Education accounted for 24% of total DDoS attacks in 2025, up from 15% the prior year, with more than 45% of attacks occurring in April and May during peak academic periods.

The number of documented DDoS attacks in the Link11 network rose by 75% in 2025, after a 137% increase the previous year.

Three DDoS attacks surpassed 1 Tbit/s in 2025.

The strongest DDoS attack measured 1.33 Tbit/s and exceeded 120 million packets per second.

Active DDoS attacks were observed 88% of the time, equating to 322 days per year when systems in the Link11 network are targeted.

The longest recorded DDoS attack lasted 12,388 minutes (over eight days) in the Link11 network.

On average, 2.8 follow-up DDoS attacks occured after an initial incident, an 80% increase compared to the previous year.

A coordinated series of DDoS attacks totaled 509 terabytes of data in 2025.

There is greater than a 70% probability that an initial DDoS attack is followed by at least one additional attack.

75% of organizations are concerned about Distributed Denial-of-Service (DDoS) attacks targeting AI agents.

The technology sector represented 45% of all network-layer DDoS attacks, up from 8.77% in 2024.

North America accounted for 63.1% of all network-layer DDoS attacks globally, followed by the Middle East (16.1%) and Europe (13.7%).

In the second half of 2025 the average Radware customer experienced more than 25,351 network-layer DDoS attacks, averaging 139 attacks per day.