DDoS is not a network problem — it’s a Zero Trust availability one

For most of its history, DDoS protection lived in the network team’s domain. Attacks were measured in bandwidth. Defenses were measured in capacity. If you had enough infrastructure to absorb the flood, you were protected.

That model worked when DDoS attacks were blunt instruments. It does not work anymore.

Modern DDoS attacks do not target bandwidth. They target the systems that modern security architectures depend on — identity providers, access gateways, APIs and cloud security services. That shift changes what DDoS protection means and where it belongs in the security conversation.

What attackers have figured out

The evolution of DDoS tactics follows a straightforward logic. As organizations hardened their networks against volumetric floods, attackers moved up the stack. Application-layer attacks require far less traffic to be effective. A precisely targeted application-layer (Layer 7) request flood against an identity provider does not need to saturate a network link. It only needs to overwhelm the application until it stops responding.

In a Zero Trust environment, that is enough to cause serious operational damage.

Every access request in a Zero Trust model initiates a chain of real-time validation. Identity must be confirmed. Device posture must be checked. Policy must be enforced. Interrupt any point in that chain and access fails — not just for one user, but potentially for an entire workforce, depending on which system is targeted.

Attackers recognize that Zero Trust enforcement points are high-value targets precisely because the architecture depends on them so completely. Compromising an identity provider through a DDoS attack does not require stolen credentials or sophisticated intrusion techniques. It requires sustained pressure on a system that cannot function in a degraded state.

Why the old ownership model creates risk

When DDoS protection is treated as a network problem, it gets scoped, funded and staffed accordingly. Network teams provision capacity against volumetric threats. Thresholds get set. Filters get configured. The assumption is that if traffic volume stays within bounds, the organization is protected.

That assumption breaks down against application-layer attacks for two reasons.

First, application-layer attacks are designed to stay within normal traffic volume ranges. They are difficult to detect using threshold-based methods because they do not look anomalous at the network level. They look like legitimate traffic until the target system begins to fail.

Second, the systems being targeted — identity providers, secure access gateways and cloud security services — are security infrastructure, not network infrastructure. The network team may not have direct visibility into whether those systems are degrading under attack. By the time the impact is visible at the network level, the damage is already done.

Treating DDoS as a network problem means applying network-layer defenses to application-layer targets. The coverage gap is structural.

Where DDoS protection actually belongs

Reframing DDoS as a Zero Trust problem changes what effective protection looks like.

It means evaluating DDoS risk at the application and identity layers, not just the network layer. It means assessing whether mitigation occurs upstream of Zero Trust enforcement points so that identity verification, least privilege access controls and continuous monitoring remain functional under attack. It means integrating DDoS visibility into security operations rather than treating it as a separate network event.

It also means recognizing that the SASE architectures many enterprises are adopting introduce their own concentration risk when not properly protected. When access enforcement, traffic inspection and policy decisions are centralized at a cloud-delivered edge, that edge becomes a single high-value target. DDoS protection needs to be embedded at that layer, not bolted on afterward.

The organizations most exposed are often those that have made the most progress on Zero Trust adoption. A mature Zero Trust architecture creates strong dependencies on always-available enforcement systems. The stronger those dependencies, the more damaging it is when availability fails.

A more complete threat model

DDoS protection has always been about keeping systems reachable. What has changed is which systems matter most.

In a perimeter-based security model, the network edge was the critical dependency. In a Zero Trust model, identity providers and access enforcement infrastructure are the critical dependencies. Protection strategy needs to follow that shift.

Organizations that continue to scope DDoS risk as a network-layer concern are solving for a threat model that no longer reflects how attacks work or how their security architecture is structured. Closing that gap is not a network project. It is a security architecture decision.

For a broader view of how Zero Trust, SASE and availability protection work together as a unified security framework, see our SASE guide.