Cloudflare published its first combined half-year DDoS report on 11 August 2026, covering January through June. It reported 935 network-layer attacks above one terabit per second during that period. DNS-based attacks represented 34.3% of the network-layer attack activity in its observations.
These figures describe traffic observed by Cloudflare. They should not be read as a complete measurement of the Internet or as evidence of the protection available from another provider.
Review the path to the service
Our assessment is that the report is a reason to revisit the scope of a protection arrangement. The application endpoint is one dependency. Authoritative DNS, upstream connectivity and any exposed administrative paths also deserve an explicit decision about protection and response.
A useful review asks where mitigation takes place, which traffic can bypass it, who can request intervention and how the team verifies that legitimate users can still reach the service. A large advertised mitigation capacity cannot answer those environment-specific questions on its own.
The operating objective should be a rehearsed escalation path with clear responsibilities between the customer, hosting operator, network and protection provider. The report supplies evidence of the wider threat environment; the service review establishes what that evidence means for a particular deployment.