Add up detection, diversion and ramp time to find your true time to mitigate, and the traffic lost before it engages.
Time to mitigate is the sum of three independent delays, and traffic is unprotected for every second of it. Because most attacks are short, that fixed overhead — not the mitigation quality — usually determines how much damage an event does. A two-minute time to mitigate against a three-minute attack means you were down for two-thirds of it, no matter how good the scrubbing was once it engaged.
DDoS Mitigation
time to mitigate = detection + diversion + ramp; unprotected seconds = min(attack duration, time to mitigate).
time to mitigate = detection + diversion + ramp; unprotected seconds = min(attack duration, time to mitigate). Time to mitigate is the sum of three independent delays, and traffic is unprotected for every second of it. Because most attacks are short, that fixed overhead — not the mitigation quality — usually determines how much damage an event does.
A two-minute time to mitigate against a three-minute attack means you were down for two-thirds of it, no matter how good the scrubbing was once it engaged.
This calculator takes 6 inputs: Detection time, Diversion time (BGP announce + propagation), Mitigation ramp / signature build time, Attack duration, Legitimate requests per second, Revenue per minute of availability. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Always-on mitigation removes detection and diversion entirely, at the cost of steady-state latency and inspection expense. If you stay on-demand, pre-agreed BGP communities, pre-built signatures and automated triggering typically take a 5-minute manual process down to under 60 seconds.