Buying managed DDoS protection in the UK is less about picking the biggest scrubbing network and more about proving three things to whoever signs the contract: that the service covers every surface an attacker can reach, that it can actually be deployed on your IP addressing, and that the SLA and the billing schedule agree with each other. Those are the points that decide whether an incident becomes a footnote in a board pack or a week of recovery.
This guide takes the buyer’s side of that conversation: what “managed”should mean in scope, where UK estates are routinely left uneven, how pricing is built, and what to do in the first hour if an attack has already started.
What the word “managed”actually buys you
The dividing line is simple. A self-service plan gives you a dashboard, a rate-limiting engine and a set of rules you write, tune and troubleshoot yourself. A managed service means a 24/7 security operations centre watches your traffic, declares an incident, applies mitigation on your behalf and tells you afterwards what it did. If a human on the provider’s side is not empowered to change policy at 03:00 without your sign-off, you have bought monitoring, not management.
A defensible scope of work includes onboarding and initial rule tuning, always-on traffic baselining, alerting to named contacts, mitigation without waiting on your approval, attack reporting with vector breakdowns, in-event change requests (whitelisting a payment partner, loosening a rate limit for a genuine campaign spike), and a written post-incident review. Ask for the escalation matrix in the contract: named engineers, an out-of-hours bridge number, and a maximum time to human contact rather than a maximum time to automated email.
Follow the resale chain before you sign
Many offers badged as managed DDoS protection are partner-programme wrappers around somebody else’s scrubbing capacity. That pattern is old and persistent: hosting providers layered their brand over specialist mitigation appliances and networks in the mid-2000s (Layered Technologies with netZentry, and the wave of Prolexic-era hosting partnerships that followed), and vendors have long run formal channel schemes such as IntruGuard’s managed security services partnership programme to let service providers resell mitigation under their own name.
Reselling is not a fault. Opacity is. Three questions settle it: who staffs the SOC you reach at 3am, whose network physically filters the packets, and who holds authority to change policy mid-attack. If the answer to the second question is a third party, ask what the reseller’s own SLA is against theirs, because you can only be covered to the depth of the weakest link in that chain.
The three surfaces UK buyers protect unevenly: network, application and DNS
Volumetric layer 3/4 floods (UDP reflection, SYN floods, carpet bombing across a whole prefix) are the surface everyone buys for. They are also the easiest for a scrubbing centre to absorb. The harder problem is application-layer traffic and automated bots that arrive at human-plausible request rates against expensive endpoints: search, basket, login, API pagination. That behaviour sits under the volumetric alarm thresholds entirely, which is why bot-management capability (Fastly Bot Management, Cloudflare Bot Management, Akamai Bot Manager and comparable tooling) belongs in the requirements list alongside raw capacity.
Authoritative DNS: the surface most often left unmanaged
An attack on your authoritative DNS produces a total blackout even when every web server is healthy, because nothing resolves. The EveryDNS episode of December 2010 made the point plainly: a DDoS aimed at a single hosted domain led the provider to drop that domain to protect the rest of its customer base, and the site went dark despite its web tier being untouched. Hybrid designs that shield on-premise and cloud DNS together, the design intent behind Akamai Shield NS53, exist precisely because organisations keep their own resolvers for internal reasons and then expose them to the internet.
Practical requirement: either two independent authoritative DNS providers with matched zones, or a shielded/anycast authoritative service with its own DDoS posture. Do not accept “our CDN covers DNS”without confirming which nameservers actually answer for the zone.
Origin IP leakage defeats proxies more often than volume does
Proxy-based protection fails most commonly because the attacker never touches the proxy. The origin address leaks through mail records on the same host, stale A records for old subdomains (dev, staging, cpanel, legacy VPN), historical DNS archives, and certificate transparency logs that publish every hostname you ever requested a certificate for. Onboarding is incomplete until the origin firewall only accepts traffic from the provider’s published ranges, mail is moved off the web address, and the leftover records are cleaned out.
Before shopping, map the exposure: every public IP range you announce or are assigned, API endpoints, VPN and remote access gateways, payment and login paths, mail, and any third-party service that hard-codes your origin. The count of protected domains and IPs is what you will be quoted against, and coordinated hacktivist campaigns hit estates rather than single hostnames. The March 2024 attacks that disrupted multiple French government services, confirmed by the Prime Minister’s office and claimed by a hacktivist group, targeted a spread of state platforms at once.
Deployment models compared: reverse proxy, BGP scrubbing and hosting-level filtering
Reverse proxy / DNS-based mitigation. You point your DNS at the provider, which terminates and filters HTTP(S) at the edge. Fast to deploy (hours, not weeks), strong for web and API traffic, weak for non-web protocols, and only as good as your origin hygiene.
BGP diversion to a cloud DDoS scrubbing service. The provider announces your prefix during an attack (or permanently) and returns clean traffic over GRE tunnels or direct connectivity. This protects every protocol, not just web. The constraint that sales decks skate over: you must be able to announce your own /24 or larger, with your own ASN and an RIR allocation. Most UK SMEs sit on provider-assigned addresses inside somebody else’s aggregate and cannot divert at all. Establish which model your IP situation permits before you start comparing SLAs, because otherwise you are comparing capabilities you cannot buy.
Hosting and data centre included protection. Upstream filtering and blackholing bundled with colocation or cloud hosting is genuinely useful, and some UK managed service providers wrap it into a wider network contract, as with Claranet’s DDoS protection offering. The question to ask in writing is what happens at threshold: does the provider filter your traffic, or null-route your IP to protect its other tenants? A null route is a successful outage from the provider’s perspective and a total outage from yours.
Always-on or on-demand
On-demand diversion is cheaper and adds no steady-state latency, but you pay for it in detection-to-diversion time, typically measured in minutes once BGP convergence is included. Short repeat bursts, the hit-and-run pattern favoured by extortion crews, punish that model: each burst lands, mitigation engages, traffic reverts, and the next burst lands again. Always-on removes that gap, at the cost of routing all traffic through the provider. For UK-facing services, check for a London point of presence and ask where clean traffic re-enters your network, since a mitigation path via Amsterdam or Frankfurt shows up in page timings.
How to compare UK DDoS mitigation providers without relying on the sales deck
Read the SLA clock and the billing clause together. A 60-second time-to-mitigate is close to worthless if the clock starts when you raise a ticket rather than when the provider’s detection fires, and a clean mitigation is a hollow win if attack traffic or the post-event burst lands on your bandwidth invoice. Get answers on:
- Clock start and remedy. Time to notify, time to mitigate, whether measurement is from detection or from your ticket, and whether the remedy is a service credit worth a few days’ fees or something proportionate.
- Capacity and architecture. Aggregate and per-PoP scrubbing capacity, PoP locations, behaviour under simultaneous multi-vector attack (layer 3 flood plus layer 7 request flood plus DNS query flood), and whether mitigation is automated or analyst-triggered.
- Data residency and logging. Where request logs and TLS termination sit, retention periods, and how that reconciles with your UK GDPR position and any sector rules.
- Billing. Whether attack traffic is unmetered, how clean-traffic overage is charged, per-protected-IP and per-domain counts, and whether burst charges can be triggered by an incident you did not cause.
- Evidence. Sample attack reports, a redacted post-incident review, references in your sector, and a pre-agreed onboarding and failover test rather than a promise to test “at some point”.
Run the failover test before go-live and again annually. It is the only way to know whether the runbook, the contact list and the tunnels still work, and it is the artefact that satisfies auditors and boards.
What managed DDoS protection costs in the UK, and how pricing is structured
Pricing splits into four recognisable shapes:
- CDN entry tiers, per domain. Published list pricing at the time of writing includes Cloudflare’s Pro plan at $20 per month and Business at $200 per month per domain. Self-service, not managed, and priced per zone, so a 30-domain estate multiplies quickly.
- Fixed monthly platform subscriptions. AWS Shield Advanced is published at $3,000 per month per organisation on a 12-month commitment, plus data transfer charges; Microsoft’s Azure DDoS Network Protection is published on a similar fixed monthly basis covering a set number of public IP resources. Check current vendor pricing pages, as these change.
- Clean-bandwidth commits. Scrubbing providers and carriers commonly price on committed clean Mbps/Gbps plus a per-prefix or per-protected-IP charge, with attack traffic excluded from metering (confirm that in writing).
- Enterprise annual contracts with a managed service fee. A platform licence plus a separate SOC/managed line item, usually on 12 to 36 month terms.
Licence cost is rarely the whole spend. Budget separately for onboarding engineering, ASN and GRE tunnel work if you are diverting via BGP, DNS migration, WAF and bot rule tuning (the phase where false positives get found, and the one most often under-scoped), and any retained incident response hours.
Emergency onboarding while an attack is running is the most expensive way to buy. Providers price it as incident work, contract lengths get longer, and the tuning that normally takes two weeks happens under load. The rapid-response arrangements publicised in the market, including Cloudflare’s partnership with Booz Allen Hamilton to assist organisations already under attack, exist for exactly that scenario, and they illustrate the premium and the constraints attached to it.
Building the business case
Boards respond to downtime cost per hour, not attack sizes in gigabits. The arithmetic is straightforward: divide annual online revenue (or the cost of the service being unavailable) by realistic trading hours. An operation taking £12m a year online across roughly 4,000 effective trading hours carries about £3,000 an hour in gross order value at risk, before support cost, chargebacks and reputational effects. Set that against annual protection spend and the case usually writes itself. Financial services teams have a shorter path still, given the availability expectations that follow incidents like the DDoS attack that disrupted National Australia Bank’s online services.
Under attack now: the first hour, ransom demands and the UK legal position
Confirm it is a DDoS before you escalate. A capacity limit, an expired certificate, a bad deployment or a DNS misconfiguration all look like an outage. Check upstream interface counters, request rates versus error rates, and whether the traffic profile is plausible. Then work the sequence: notify your ISP and upstream hosting provider, since filtering closest to the source is the most effective option available, apply rate limiting where you can, and trigger the provider escalation path with a named contact rather than a web form. CISA’s guidance on understanding and responding to denial-of-service attacks sets out the same priorities, including engaging your service provider early and pre-planning the response.
If a ransom note arrives, do not pay. Preserve the demand with full email headers, keep flow data and logs, and report it: Action Fraud for the crime report (Police Scotland in Scotland) and the NCSC’s reporting route for significant incidents. Extortion crews test for payers, and the pattern of hit, demand and repeat has been prosecuted for two decades, as the Russian cyber-blackmail gang jailed for attacks on bookmakers demonstrated. Attack capacity itself remains a botnet supply problem, which is why coordinated botnet reduction initiatives keep reappearing on national agendas. The FBI and CISA have also issued joint public warnings about denial-of-service activity degrading access to public-facing critical infrastructure services, including their September 2020 advisory on DDoS against election infrastructure.
The legal and regulatory frame
Launching a DDoS attack is a criminal offence in the UK under the Computer Misuse Act 1990, section 3, as amended by section 36 of the Police and Justice Act 2006 to cover unauthorised acts intended to impair the operation of a computer. Custodial sentences are on record: Daniel Kaye was sentenced to two years and eight months at Blackfriars Crown Court in January 2019 over attacks that disrupted a Liberian telecoms operator.
Three regulatory duties shape requirements more than most procurement teams expect. Operators of essential services and relevant digital service providers carry security and incident-reporting obligations under the NIS Regulations 2018. FCA-regulated firms have to identify important business services and impact tolerances under the operational resilience regime (PS21/3), with firms required to be operating within those tolerances from 31 March 2025. And availability is a security requirement under UK GDPR, not just a commercial one, so a prolonged outage affecting personal data systems can carry regulatory questions alongside the revenue loss.
The decision, in the end, rests on fit rather than brochure capacity. Confirm which deployment model your addressing allows, cover network, application and authoritative DNS to the same standard, lock the origin, and make sure the SLA clock and the billing clause tell the same story. Managed DDoS protection bought on those terms in the UK is defensible in front of a board; a plan bought on peak-gigabit figures alone usually is not.
Frequently Asked Questions
What is managed DDoS protection, and how is it different from a self-service plan?
Managed protection means a provider’s SOC monitors your traffic, declares incidents, applies and tunes mitigation on your behalf, and reports afterwards. A self-service plan gives you the same filtering platform but leaves detection thresholds, rule writing and in-event decisions to your team. The practical test is whether the provider can change policy during an attack without waiting for your approval.
How much does managed DDoS protection in the UK typically cost?
Pricing follows four models: per-domain CDN tiers (Cloudflare publishes $20 and $200 per month for Pro and Business), fixed monthly platform subscriptions (AWS Shield Advanced is published at $3,000 per month per organisation on an annual commitment), committed clean-bandwidth pricing, and enterprise annual contracts with a separate managed service fee. Add onboarding engineering, DNS migration, tunnel setup and rule tuning to the licence cost, and treat any figure as a placeholder until you hold a written quote.
Does the DDoS protection included with my hosting or data centre cover me?
Partly. Bundled upstream filtering handles routine volumetric noise well, but ask what happens when the attack exceeds the platform threshold: many providers null-route the targeted IP to protect other tenants, which ends the attack and your availability at the same time. Get the threshold, the response action and the notification commitment in writing.
Do I need separate DNS DDoS protection if I already use a CDN?
Only if the CDN is genuinely authoritative for your zone and its DNS service carries its own mitigation and SLA. Plenty of organisations proxy their web traffic while leaving authoritative DNS on a small provider or an on-premise resolver, which leaves a single point of total failure. Either use two independent authoritative providers with matched zones, or a shielded anycast DNS service.
Can I get managed DDoS protection set up while an attack is in progress?
Yes. DNS or proxy-based onboarding can be completed quickly, and specialist rapid-response arrangements exist for organisations already under attack. Expect premium pricing, longer contract terms and imperfect tuning, and expect to fix origin exposure under load, which is why pre-contracting is materially cheaper.
Are DDoS attacks illegal in the UK, and can I take legal action after one?
They are criminal offences under section 3 of the Computer Misuse Act 1990 as amended by section 36 of the Police and Justice Act 2006, and UK courts have imposed custodial sentences. Report through Action Fraud (Police Scotland in Scotland) and the NCSC, preserve logs, flow data and any ransom correspondence with headers intact, and take separate legal advice on civil claims, which are usually difficult where attackers are overseas or unidentified.
Should we ever pay a ransom DDoS demand?
No. Payment marks you as a paying target, offers no guarantee the attack stops, and funds further activity, and there may be sanctions exposure depending on who is behind the demand. Report it, keep the evidence, and put the money into mitigation capacity and a tested runbook instead.