DDoS Attack Cost: What Denial of Service Incidents Cost in 2026
A Distributed Denial of Service (DDoS) attack floods a target with traffic to make it unavailable to legitimate users. Unlike ransomware or breaches, DDoS attacks do not exfiltrate data, but they cause direct revenue loss through downtime and can be used as a pressure tactic alongside ransomware (triple extortion). DDoS attack cost varies enormously based on duration, organisation revenue, and whether the target has mitigation in place.
Cost Components
| Cost Category | Range | Notes |
|---|---|---|
| Revenue loss during attack | $0-$1M+ | Scales with hourly revenue and attack duration |
| Bandwidth overage charges | $0.05-$0.50/GB overage | Without DDoS scrubbing, ISP charges apply |
| Emergency mitigation service | $10K-$100K | One-time emergency on-ramp without existing contract |
| On-call engineering time | $5K-$50K | Senior engineers during multi-hour attack |
| Ransom DDoS demand (if present) | $5K-$500K in crypto | Attackers demand payment to cease attack |
| Reputation and customer trust | $20K-$200K | PR, customer communication, SLA credits |
| Post-incident hardening | $10K-$150K | Infrastructure changes, scrubbing service setup |
Types of DDoS Attack and Cost Profiles
| Attack Type | Method | Cost Profile |
|---|---|---|
| Volumetric flood | Saturate bandwidth with high-volume traffic (UDP floods, DNS amplification) | Low cost without mitigation; completely blocked with scrubbing |
| Protocol attack (SYN flood) | Exhaust state tables on firewalls and load balancers | Moderate cost; server infrastructure damage possible |
| Application layer (Layer 7) | HTTP floods targeting specific endpoints; hard to distinguish from legitimate traffic | Highest cost per Gbps; bypasses simple mitigation |
| Ransom DDoS (RDDoS) | Volumetric attack with ransom demand to cease | Add $5K-$500K extortion demand to base attack cost |
Mitigation Cost vs Incident Cost
Cloud-based DDoS scrubbing services prevent most of the revenue and downtime cost at a fraction of the expected incident cost:
| Provider | Entry Tier | Enterprise Tier | Coverage |
|---|---|---|---|
| Cloudflare | $20/mo (Magic Transit from $0.05/MB) | $50K-$200K/yr | Layer 3-7, unlimited mitigation on enterprise |
| AWS Shield | Standard: Free | Advanced: $3K/mo + data transfer | Layer 3-7 for AWS resources |
| Akamai (Prolexic) | Custom enterprise pricing | $50K-$300K/yr | Network-level and app-layer scrubbing |
| Cloudflare (Magic Transit) | Starts at $1K/mo | $20K-$100K/yr | Network-level full BGP diversion |
What DDoS Testing Costs
Authorised DDoS testing is priced per engagement by a short list of pre-approved partners, and neither AWS nor Microsoft publishes a rate card for it. What both publish instead are the rules, and the rules are what actually set the size of the bill: you may only simulate against resources you own, the test has to be run by a named partner, and the traffic is capped well below what a real attack delivers. A test is a scoped consulting engagement plus the protection subscription it requires, not a metered service you buy by the gigabit.
| Platform rule | AWS | Microsoft Azure |
|---|---|---|
| Who may run the test | An AWS Partner Network partner pre-approved by AWS: NCC Group plc, RedWolf Security, Red Button, Safedash Analytics | An approved Microsoft testing partner: MazeBolt, Red Button, RedWolf (Red Button is Public cloud only) |
| What may be targeted | A resource registered as a Protected Resource in an AWS account you own and subscribed to AWS Shield Advanced | An Azure-hosted public IP in your own subscription, validated by the partner, protected under Azure DDoS Protection |
| Traffic ceiling | 20 Gbps; 5 million packets per second against CloudFront, 50,000 packets per second against any other resource type; 50,000 requests per second | Set by the partner engagement; Microsoft advises testing in staging or off-peak hours |
| Going outside the rules | A vendor that is not pre-approved, or a test above the technical limits, needs an exception form submitted at least 14 days before the test date | Not offered; only the three approved partners may simulate |
The practical budget has three lines, and only one of them is the test itself. First, the protection subscription the platform requires before it will let you test at all (AWS Shield Advanced, or an Azure DDoS Protection plan). Second, the partner engagement, which is quoted rather than listed: Microsoft's documentation describes Red Button's controlled attack stage as typically three to six hours of multi-vector traffic, wrapped in a planning session beforehand and a written test report afterwards, so it is billed as a project rather than by attack volume. Third, the staging environment you run it against, if you follow the advice not to test in production.
Anything cheaper than that is usually not a test. Booter and stresser services sell traffic against a target on request and do not verify that you own it. In the UK, section 3 of the Computer Misuse Act 1990 makes an unauthorised act done with intent to impair the operation of a computer an offence carrying up to ten years' imprisonment on indictment, and that applies to traffic you commissioned against your own supplier, your own CDN edge, or a shared host, none of which you own outright.
Sources, checked 7 September 2026: AWS DDoS Simulation Testing policy · Azure DDoS Protection simulation testing · Computer Misuse Act 1990 s.3
Notable DDoS Events
| Event | Year | Scale | Impact |
|---|---|---|---|
| Dyn DNS DDoS (Mirai botnet) | 2016 | 1.2 Tbps | Amazon, Netflix, Twitter, GitHub, NY Times disrupted; millions lost in e-commerce revenue |
| GitHub DDoS (Memcached amplification) | 2018 | 1.35 Tbps | Record at the time; GitHub mitigated in 10 minutes via Akamai Prolexic |
| AWS DDoS | Feb 2020 | 2.3 Tbps | Largest ever at time; mitigated by AWS Shield Advanced |
| Cloudflare mitigated attack | 2024 | 5.6 Tbps | Largest on record; 13,000 source IPs; mitigated automatically |