Year-over-year increase in peak attack sizes
Largest observed attack volume in 2025
Shortest pulse attack wave — over before most systems respond
Unique attack vectors observed in a single campaign
Most of what's hitting your network isn't registering. 56% of sub-1G attacks are under 200 Mbps — small enough to look like normal traffic fluctuation on most dashboards. These aren't misses. They're recon.
The year every record became the new normal.
In 2025, peak attack sizes jumped 262% year over year. Pulse attacks hit terabit scale in six seconds — over before most mitigation systems finish classifying the threat. Campaigns ran 50+ simultaneous vectors, adapting in real time.
These aren't projections. They're what our SOC recorded on real customer networks. The 2026 TIR covers the full picture: the volume explosion, pulse attack mechanics, multi-vector behavior, and where the data says this is heading.
GET THE REPORTThreat Intelligence Report 2024/25
Attack volumes scaled sharply in 2024. Pulse attacks emerged as the dominant technique, and multi-vector campaigns became the new standard. The data that set the stage for 2025's record-breaking year.
Read the ReportThreat Intelligence Report 2022/23
Corero's 2022/23 analysis documented the early rise of multi-vector campaigns and increasing attack automation — the structural shifts that defined what DDoS became in the years that followed.
Read the Report
Botnets aren't what they were two years ago. Mikrotik and Mirai have both matured — and the campaigns they're running now are faster, more adaptive, and a lot harder to classify in real time. This note covers what's actually changed and what a current response looks like.
Read the Note
Mirai keeps getting written off. It keeps showing up. This note covers how it adapts, what its common attack methods look like on a live network, and why IoT vulnerabilities keep giving it new attack surface — years after it was supposed to be a solved problem.
Read the Note
SmartWall ONE™ is already a top-tier, automated defense system that can handle massive attacks. But even the best defenses can benefit from a little upkeep. Paired with SmartWall ONE, our new SecureWatch services ensure you have the strongest protection possible.
