Radware DDoS Protection — DefensePro, Cloud DDoS & the Hybrid Model

① Why one layer isn't enough — the pipe-vs-latency trade-off

The single most important idea: no one layer wins alone. An on-prem appliance like DefensePro is fast — it scrubs at the edge in milliseconds with almost no added latency — but it can only clean what reaches it. If a volumetric flood is bigger than your internet pipe, the link is already saturated upstream of the box; the appliance reports 'mitigating' while users still see an outage.

A pure cloud service solves the pipe problem with massive capacity, but routing all traffic through a distant scrubbing center adds latency and cost you may not want full-time. That tension — local speed versus cloud capacity — is exactly what Radware's portfolio resolves: detect locally, scrub globally, and hand off automatically when the pipe is threatened.

② Meet the components — appliance, cloud, console and people

Four pieces, one job each. DefensePro is the on-prem appliance (hardware or virtual DPVA): inline or out-of-path, it does patented behavioral, real-time detection with no pre-set signatures, covering network, DNS, low-and-slow, burst, Layer-7 / Web DDoS and encrypted attacks. The Cloud DDoS Protection Service is the muscle — a global, full-mesh Anycast scrubbing network (commonly cited at ~15 Tbps+) that absorbs the volume an appliance never could.

The cockpit and the people

APSolute Vision — delivered within Radware's Cyber Controller — is the single console to configure policy, monitor the attack lifecycle, run forensics and report across many DefensePro devices and sites, with SIEM/NMS/ticketing integration. Behind it sits the ERT (Emergency Response Team): Radware's 24x7 SOC-backed experts who help mitigate live attacks, with emergency onboarding for customers already under fire and a strong time-to-detect/divert/mitigate SLA.

③ How the hybrid model actually works — the gapless handoff

Hybrid is where it clicks. DefensePro watches normal traffic and, the moment it sees an anomaly, its BDoS (Behavioral DoS) engine auto-generates a precise Real-Time Signature in roughly 18 seconds — blocking the attack while legitimate traffic flows, with no human in the loop. For everyday attacks that fit your pipe, the appliance alone finishes the job.

When the inbound rate climbs toward link capacity, Cloud Signaling fires: DefensePro sends an automated message to the Radware cloud asking it to divert and scrub. Traffic is steered into DefensePipe (the branded cloud diversion path) via BGP or DNS, cleaned in the nearest scrubbing center, and the clean traffic is returned to you. No phone call, no manual reroute — the handoff happens in seconds, which is the whole point of 'hybrid'.

④ Choosing your deployment — always-on, on-demand or hybrid

Three cloud deployment modes, chosen by your constraints. Always-on permanently routes all traffic through the cloud — lowest risk, no on-prem box required, but it adds steady latency. On-demand only diverts when the pipe is threatened — the lowest-cost option, with a brief activation delay at the start of an attack. Hybrid keeps DefensePro doing instant local detection/mitigation and uses the cloud only for volumetric scrubbing via Cloud Signaling — best of both, but you must host and size the appliance.

Pick by three questions

How much latency can you tolerate? How big is your pipe versus the floods you expect? Can you host an appliance on-site? Latency-sensitive with a box you can host points to hybrid; no appliance and want simplicity points to always-on; cost-sensitive with rare attacks points to on-demand. The classic failure is running an appliance with Cloud Signaling left unconfigured — so a flood saturates the pipe and the cloud never gets the divert request.