A DDoS reseller partner program is sold to you as a revenue line. Read the contract properly and it is also a risk transfer, because the moment a customer’s checkout page falls over, the person they phone is you, not the vendor whose scrubbing centres are doing the work. Hosting providers have been in this position for two decades: mitigation vendors have partnered with hosts since the mid-2000s, when firms such as Layered Technologies worked with netZentry to put attack mitigation in front of hosting customers. Attack sizes have gone from gigabits to terabits since then. The commercial mechanics of a partner agreement have barely moved.
What follows is the due-diligence side of the table: seven terms to interrogate before you sign, written for the commercial director or technical lead who will have to support the thing at 3am.
Why hosts and MSPs resell DDoS protection instead of building it
Three buyer profiles drive most of this search traffic. Hosting and VPS providers bleeding customers to attack-driven churn, where one noisy tenant brings a whole range under fire. Managed service providers whose existing clients have started asking for mitigation in renewal conversations. And colocation and data centre operators whose tenants now write availability protection into the contract rather than hoping for it.
Building your own capability is possible, and for a handful of operators it is the right answer. The bill is rarely just hardware. You are buying upstream transit headroom you will not use on a normal day, scrubbing appliances or cloud capacity, 24/7 network operations cover, and the much harder thing to recruit: people who can read a flow graph at three in the morning and tell a flash crowd from a carpet-bomb attack across a /24.
There is an honest alternative to signing anything. You can simply point customers at a mitigation provider, charge nothing, and keep your hands clean. You lose the margin and the stickiness, but you also lose the liability. The decision to run a partner programme is a decision to own the relationship and the support burden. Worth saying out loud before the commission rates get discussed.
Referral, white-label or managed partner: three models, three risk profiles
- Referral or agency. You pass the lead, the vendor contracts with and supports the customer, you take a commission. Almost no risk, almost no margin, and no control over the renewal.
- Reseller or white-label. You contract with the vendor, rebrand the service, set your own retail price, and own first-line support plus whatever SLA your customer signs. The margin lives here. So does the exposure.
- Managed partner. You buy capacity wholesale and make mitigation decisions yourself. That requires portal rights, written runbooks, and staff who can judge a traffic baseline without ringing the vendor first.
Pick on an honest self-assessment rather than on ambition. Do you have anyone who can triage an application-layer flood at the weekend, or are you selling a logo on a status page? Vendor-side programmes have been structured around exactly this split for years; the IntruGuard managed security services partnership programme is an early example of the model aimed squarely at service providers who wanted to bill for mitigation without owning the appliances.
Terms 1 to 3: the clauses that decide your margin
Term 1: how the wholesale price is actually built
Managed DDoS protection in the UK is almost never priced as one number. Expect a stack: a base platform fee, a clean-traffic commit in Mbps or Gbps, a per-protected-IP or per-prefix charge, a per-DNS-zone charge if authoritative DNS is in scope at all, and professional services for onboarding, tunnel builds and route testing.
Ask for every line item in writing and rebuild the monthly cost yourself for a representative customer. Resellers who price retail off the headline platform fee discover the rest of the stack on the first invoice.
Term 2: minimum commitment and tier mechanics
Annual volume floors are where partner programmes quietly become expensive. Establish how the tiers step, whether a tier change is prospective or retrospective, whether unused commit rolls forward into the next period, and what happens if you sell half of what you forecast in the sales meeting where everyone was optimistic. Some agreements true up; some simply bill the floor. Both are defensible. Only one is survivable if your pipeline slips a quarter.
Term 3: who pays for the overage
Overage is the clause that turns a flat retail price into a loss. Three mechanisms to pin down: how clean-traffic bursts above commit are charged, whether there is a per-attack-event fee, and whether volume is measured on peak or average. Peak-based measurement on a 95th percentile or a monthly maximum behaves very differently from an average during a week of sustained attack.
A worked example. Say you buy a 200 Mbps clean-traffic commit with per-event attack charges, and sell the customer one flat monthly price because that is what they asked for. Three mitigation events in a quarter and your margin is gone, unless you capped the events, passed the charges through, or priced the risk in from the start. Decide which of those three you are doing before the contract is signed, not after the invoice arrives.
Price retail from downtime cost, not cost-plus
Cost-plus pricing drags the customer conversation down to pence per megabit, which is an argument you cannot win against a hyperscale platform’s list price. The more defensible approach is to price against the revenue the customer protects: order value per hour, staff standing idle, contractual service credits they owe their own clients. Our guide to building a board-ready DDoS protection business case sets out that model in more detail, and it is the same arithmetic your customer’s finance director will apply to your quote.
Terms 4 and 5: what the resold service actually protects
Term 4: the three surfaces, and the one that goes missing
Any resold bundle should be assessed across three protected surfaces, and most datasheets only talk about one:
- Network and transport layer. Volumetric floods, amplification and reflection, measured in Gbps and packets per second.
- Application layer. HTTP and API request floods, slow requests, credential-stuffing traffic that looks almost legitimate.
- Authoritative DNS. The zones that tell the world where your customer’s service lives.
Authoritative DNS is the layer most often left unmanaged, and the one most often absent from a reseller bundle. The pattern repeats itself: a partner sells network and application cover, the customer’s zones stay on a registrar’s free nameservers, and the first DNS-targeted flood takes the site offline despite a signed mitigation contract that is working perfectly on the surfaces it covers. Check whether zones, query volumes and anycast coverage sit inside the wholesale price or are a separate product with its own commit.
The other common gap is sold as a strength. A 100 Gbps layer 3/4 bundle does nothing for a sustained HTTP request flood against a login or checkout endpoint, because no part of that bundle inspects application traffic. A VPS host in that position loses the customer, not the attack. On a datasheet, the tell is capacity figures everywhere and no mention of request-rate limiting, JavaScript or managed challenges, bot management, or a WAF rule set.
Term 5: always-on, on-demand and whose clock starts when
Time-to-mitigate commitments rarely survive being resold. Vendor SLAs typically start the clock at detection inside their own platform, not at the moment your customer phones your support line and your engineer starts reading logs. On-demand models then add real-world delay on top: BGP route propagation when a prefix is advertised to the scrubbing network, or GRE tunnel and proxy re-pointing when traffic is redirected. None of that is unreasonable. It just means a reseller who publishes a tighter SLA than the one they buy has taken on liability they have no technical ability to control.
Establish four things in writing: who is permitted to trigger diversion, how long propagation realistically takes in the vendor’s own incident reports, whether the SLA clock starts at detection or at ticket, and what happens overnight and at weekends. The mechanics of diversion and return are covered further in our explainer on how a cloud DDoS scrubbing service really works.
Then price the add-ons. DNS, WAF and bot management may be included, bundled at a partner discount, or sold separately at a figure that destroys your retail position the moment a customer compares it with a platform that bundles all three.
Terms 6 and 7: support, escalation and getting out
Term 6: escalation rights during a live attack
Portal permissions decide whether your service is real. If only the vendor’s NOC can move a customer from on-demand to always-on, or generate a mitigation report, then your first-line support is a message relay with a logo on it. Negotiate before signing, not after the first incident:
- Named NOC contacts and an out-of-hours escalation number, not a shared ticket queue;
- Documented response times for partner tickets as against direct customer tickets, which are frequently not the same;
- Sub-account permissions, so your engineers can see and act on a specific customer’s traffic without seeing everyone else’s;
- Alerting that reaches your team first, so you are not learning about the attack from your own customer;
- Self-serve access to post-incident reporting.
That last point gets underestimated. After any significant event you will be asked for an attack timeline, peak bandwidth and packet rates, vectors observed and mitigation actions taken. Your customer’s board will want it, their insurer may require it, and regulated customers will need it for their own reporting.
Term 7: portability and exit
Exit terms are tedious to read and expensive to ignore. Who owns the IP space and the ASN the service is built on? If protection is delivered on vendor-assigned addresses, migrating away means renumbering customer services, which is a project, not a notice period. Ask how long unwinding a GRE tunnel or moving DNS authority back actually takes, allowing for TTLs that someone set to 86400 years ago.
Check the notice period on both sides, any auto-renewal, and whether the vendor is contractually free to approach your customer directly once they know who they are. A non-solicitation clause is a fair thing for a reseller to ask for.
On branding, white-label means different things in different programmes. Test the portal, the automated email alerts, the status page and the PDF reports. Vendor logos have a habit of surviving in exactly the document your customer forwards to their board.
Judging a vendor’s capacity and performance claims as a partner, not a prospect
Advertised capacity is not capacity available to your customer. A multi-Tbps figure describes the vendor’s aggregate global network. It is not one point of presence, not a per-customer allocation, and not what is spare during a concurrent event somewhere else on the platform. Our breakdown of how much Tbps scrubbing capacity you actually need goes through that arithmetic; as a partner, the question to ask is narrower. Which scrubbing locations serve the regions your customers sit in, and what is the latency penalty when London traffic is cleaned in Frankfurt, or Singapore traffic in California?
Ask for evidence rather than adjectives. Redacted mitigation reports from real events. SLA credit history. A description of how the platform handled a multi-vector attack that combined a volumetric flood with a DNS query flood, because that combination is the one that exposes single-surface architectures.
And test the support experience before you sign. Raise a genuine technical question as a prospective partner, something that requires an engineer rather than a salesperson, and time the reply. That response is the best available preview of what your customers will experience through you. The National Cyber Security Centre’s denial of service guidance collection is a useful neutral yardstick for the questions a competent provider should be able to answer without hesitating.
Mistakes partners make, and the questions to ask on the first call
Four recur often enough to be predictable. Publishing a time-to-mitigate figure you do not technically control. Selling network-layer protection to an ecommerce or API customer whose real exposure is the application layer and authoritative DNS. Assuming white-label covers everything a customer sees. And forgetting the data protection and regulatory duties that travel with the contract.
That last one deserves a line of its own. If you are handling traffic and log data on behalf of a customer, you may be acting as a processor under UK GDPR, with Article 28 terms that need to flow down from you to the vendor consistently. Separately, customers in scope of the Network and Information Systems Regulations 2018, and those preparing for the duties in the Cyber Security and Resilience Bill now before Parliament, will push availability evidence and incident timelines back on to you. NCSC advisories about hacktivist DDoS activity tend to trigger a wave of those requests at once, from several customers, on the same afternoon.
Put these to the vendor in writing before the first contract draft:
- Every pricing component, including per-IP, per-prefix, per-zone and onboarding charges, and whether volume is billed on peak or average;
- Exactly which surfaces are covered, and whether DNS, WAF and bot management are included or separate SKUs;
- What counts as a chargeable attack event, and how concurrent or repeated events in one day are counted;
- Where the SLA clock starts, and who may trigger diversion out of hours;
- Sub-account permissions, alerting and reporting rights for your team;
- Notice periods, renumbering implications and whether the vendor may contact your customers directly.
Get satisfactory answers to those and a DDoS reseller partner program can be a sound, sticky revenue line with a genuine service wrapped around it. Get vague ones and you are underwriting someone else’s platform. If you are weighing this up for tenant-facing protection specifically, read our data centre DDoS protection checklist for colocation operators next, which covers the same questions from inside the facility.
Frequently Asked Questions
What is a DDoS reseller partner program, and how does it differ from a referral scheme?
A reseller programme means you contract with the mitigation vendor, buy capacity wholesale, set your own retail price and own the customer relationship, including first-line support and the SLA your customer signs. A referral or agency scheme means you pass the lead and the vendor contracts with the customer directly, paying you a commission. Referral carries almost no risk and almost no margin; reselling carries both.
Do I need my own ASN or IP space to resell DDoS protection?
Not usually. Many partners deliver protection on vendor-assigned addresses or through proxy and DNS-based onboarding, which needs no ASN at all. Owning your own address space and ASN does make BGP-based diversion and, more importantly, exit and migration considerably less painful, so it is worth clarifying whose addresses the service sits on before you sign.
How is reseller margin usually structured in a managed DDoS agreement?
Typically as a wholesale discount off a list price, often stepped by annual commitment tier, with the partner free to set retail pricing. The margin is only as real as your control over overage, so check whether clean-traffic bursts and per-attack-event charges are capped, passed through, or absorbed by you. Measurement on peak rather than average traffic is the detail that most often erodes a forecast.
Who handles support when a resold customer is under attack?
In a white-label arrangement, your team takes the first call and the vendor’s NOC does the mitigation work behind you. Whether that is useful support or a message relay depends entirely on portal permissions: if your engineers cannot see live traffic, switch a customer to always-on, or pull a mitigation report themselves, you are forwarding emails during the worst hour of your customer’s month.
Does a white-label DDoS bundle normally include authoritative DNS protection?
Frequently not, and that is the gap to check first. Plenty of bundles cover network, transport and application layers while the customer’s zones remain on a registrar’s free nameservers with no anycast resilience. Confirm whether DNS zones, query volumes and anycast coverage are inside the wholesale price or sold as a separate product with its own per-zone charges.