DDoS Attack Cost: What Denial of Service Incidents Cost in 2026
Direct answer. A DDoS attack costs roughly $120,000 at the low end for an SMB with no mitigation in place, rising to $2M or more for a large enterprise hit by a sustained multi-hour Layer 7 attack. The bill is driven by lost revenue during downtime, emergency mitigation, and engineering time, not by the attack traffic itself. A ransom DDoS (RDDoS) demand adds an extortion decision on top, though no reliable public dataset gives a typical demand size. Standing mitigation is far cheaper than absorbing an attack: Cloudflare includes unmetered DDoS protection on every plan (including free), and AWS Shield Advanced is $3,000/month.
A Distributed Denial of Service (DDoS) attack floods a target with traffic to make it unavailable to legitimate users. Unlike ransomware or breaches, DDoS attacks do not exfiltrate data, but they cause direct revenue loss through downtime and can be used as a pressure tactic alongside ransomware (triple extortion). DDoS attack cost varies enormously based on duration, organisation revenue, and whether the target has mitigation in place.
Cost Components
| Cost Category | Range | Notes |
|---|---|---|
| Revenue loss during attack | $0-$1M+ | Scales with hourly revenue and attack duration |
| Bandwidth overage charges | $0.05-$0.50/GB overage | Without DDoS scrubbing, ISP charges apply |
| Emergency mitigation service | $10K-$100K | One-time emergency on-ramp without existing contract |
| On-call engineering time | $5K-$50K | Senior engineers during multi-hour attack |
| Ransom DDoS demand (if present) | Not publicly quantified | Set per target and rarely disclosed; paying does not guarantee the attack stops |
| Reputation and customer trust | $20K-$200K | PR, customer communication, SLA credits |
| Post-incident hardening | $10K-$150K | Infrastructure changes, scrubbing service setup |
Types of DDoS Attack and Cost Profiles
| Attack Type | Method | Cost Profile |
|---|---|---|
| Volumetric flood | Saturate bandwidth with high-volume traffic (UDP floods, DNS amplification) | Low cost without mitigation; completely blocked with scrubbing |
| Protocol attack (SYN flood) | Exhaust state tables on firewalls and load balancers | Moderate cost; server infrastructure damage possible |
| Application layer (Layer 7) | HTTP floods targeting specific endpoints; hard to distinguish from legitimate traffic | Highest cost per Gbps; bypasses simple mitigation |
| Ransom DDoS (RDDoS) | Volumetric attack with ransom demand to cease | Adds an extortion decision to the base attack cost; demand sizes are not publicly quantified |
Mitigation Cost vs Incident Cost
Cloud-based DDoS scrubbing services prevent most of the revenue and downtime cost at a fraction of the expected incident cost:
| Provider | Entry Tier | Enterprise Tier | Coverage |
|---|---|---|---|
| Cloudflare (application/WAF) | Free: unmetered DDoS on every plan; Pro $25/mo ($20/mo billed annually) adds WAF | Enterprise: custom (advanced WAF, SLA) | Layer 3-7; absorbs attack traffic "at no additional cost, regardless of size or duration" |
| AWS Shield | Standard: free for all AWS customers | Advanced: $3,000/mo (1-year commitment) + data-transfer-out fees | Layer 3-7 for AWS resources; adds 24/7 DDoS Response Team + cost protection |
| Cloudflare Magic Transit | Custom / quote-based (not published; "Talk to an expert") | Enterprise contract | Network-layer (BGP) protection for your own IP space |
| Akamai (Prolexic) | Custom / quote-based (not published) | Enterprise contract | Network-level and app-layer scrubbing |
Sources, checked September 2026: AWS Shield pricing ($3,000/mo, 1-year commitment) · Cloudflare plans (Pro $25/mo, $20/mo annual) · Cloudflare DDoS (unmetered mitigation). Magic Transit and Akamai Prolexic are quote-only; no public rate card.
What DDoS Testing Costs
Authorised DDoS testing is priced per engagement by a short list of pre-approved partners, and neither AWS nor Microsoft publishes a rate card for it. What both publish instead are the rules, and the rules are what actually set the size of the bill: you may only simulate against resources you own, the test has to be run by a named partner, and the traffic is capped well below what a real attack delivers. A test is a scoped consulting engagement plus the protection subscription it requires, not a metered service you buy by the gigabit.
| Platform rule | AWS | Microsoft Azure |
|---|---|---|
| Who may run the test | An AWS Partner Network partner pre-approved by AWS: NCC Group plc, RedWolf Security, Red Button, Safedash Analytics | An approved Microsoft testing partner: MazeBolt, Red Button, RedWolf (Red Button is Public cloud only) |
| What may be targeted | A resource registered as a Protected Resource in an AWS account you own and subscribed to AWS Shield Advanced | An Azure-hosted public IP in your own subscription, validated by the partner, protected under Azure DDoS Protection |
| Traffic ceiling | 20 Gbps; 5 million packets per second against CloudFront, 50,000 packets per second against any other resource type; 50,000 requests per second | Set by the partner engagement; Microsoft advises testing in staging or off-peak hours |
| Going outside the rules | A vendor that is not pre-approved, or a test above the technical limits, needs an exception form submitted at least 14 days before the test date | Not offered; only the three approved partners may simulate |
The practical budget has three lines, and only one of them is the test itself. First, the protection subscription the platform requires before it will let you test at all (AWS Shield Advanced, or an Azure DDoS Protection plan). Second, the partner engagement, which is quoted rather than listed: Microsoft's documentation describes Red Button's controlled attack stage as typically three to six hours of multi-vector traffic, wrapped in a planning session beforehand and a written test report afterwards, so it is billed as a project rather than by attack volume. Third, the staging environment you run it against, if you follow the advice not to test in production.
Anything cheaper than that is usually not a test. Booter and stresser services sell traffic against a target on request and do not verify that you own it. In the UK, section 3 of the Computer Misuse Act 1990 makes an unauthorised act done with intent to impair the operation of a computer an offence carrying up to ten years' imprisonment on indictment, and that applies to traffic you commissioned against your own supplier, your own CDN edge, or a shared host, none of which you own outright.
Sources, checked 7 September 2026: AWS DDoS Simulation Testing policy · Azure DDoS Protection simulation testing · Computer Misuse Act 1990 s.3
Notable DDoS Events
| Event | Year | Scale | Impact |
|---|---|---|---|
| Dyn DNS DDoS (Mirai botnet) | 2016 | 1.2 Tbps | Amazon, Netflix, Twitter, GitHub, NY Times disrupted; millions lost in e-commerce revenue |
| GitHub DDoS (Memcached amplification) | 2018 | 1.35 Tbps | Record at the time; GitHub mitigated in 10 minutes via Akamai Prolexic |
| AWS DDoS | Feb 2020 | 2.3 Tbps | Largest ever at time; mitigated by AWS Shield Advanced |
| Cloudflare mitigated attack | Oct 2024 | 5.6 Tbps | Record at the time; 13,000 source IPs; mitigated automatically |
| Cloudflare mitigated attack | 2025 | 31.4 Tbps | Largest publicly disclosed to date; ~35 seconds; part of the Aisuru-Kimwolf botnet surge (Cloudflare Q4 2025 DDoS report) |
Peak-size record source: Cloudflare DDoS Threat Report, 2025 Q4 (31.4 Tbps, largest publicly disclosed; checked September 2026).