Cloudflare debuts Unmetered Mitigation service for free protection against large DDoS attacks
Louise Matsakis / Motherboard :
Context & Ripple Effects
Unmetered Mitigation extends a playbook Cloudflare had already been running: it later extended free security services to US political campaigns and built Spectrum for enterprises that need DDoS protection on any internet-connected container or VM. The pitch here is that the bill, not the attack, is what turns a volumetric flood into an outage.
The corpus shows why the guarantee matters: Cloudflare's own incident reports chart an escalating arms race, from a 17.2M rps attack roughly triple anything seen before to a 26M rps HTTPS flood that hit a customer on its Free plan and eventually a record 7.3Tbps blast delivering 37.4TB of junk traffic in 45 seconds. Committing to absorb those volumes without metering turns mitigation capacity into a competitive weapon.
First-order effects
- Cloudflare customers, including those on its Free plan, no longer face usage-based charges when an attack spikes their traffic — the named victims in Cloudflare's later reports (financial-industry and crypto-industry targets) are exactly the profiles this pricing removes the ransom leverage from.
- Attack economics shift immediately: flooding a target to inflate its bandwidth bill stops working against Cloudflare-protected sites, since the mitigation layer absorbs the surge at no marginal cost to the customer.
Second-order effects
- Rivals selling metered or tiered DDoS mitigation are pushed toward flat, included protection as the default, compressing the price of a service line many providers treated as premium revenue.
- Free-plan adoption becomes a funnel: sites that sign up for free attack protection sit inside Cloudflare's network, giving the company upsell paths into paid services like the Spectrum offering it launched for large enterprise clients.
Third-order effects
- If the pattern holds, DDoS mitigation stops being a purchasable product and becomes a baseline property of the edge network itself, with vendors competing on absorbed attack scale — the trajectory the corpus records in ever-larger mitigated peaks — rather than on per-gigabyte pricing.
- Volumetric attacks migrate from a direct extortion tool toward nuisance and reconnaissance, forcing defenders and regulators to weigh protection guarantees as critical-infrastructure norms rather than commercial add-ons.
The trend: DDoS protection is moving from a metered, priced service to an unmetered baseline bundled into edge networks, with each vendor's largest mitigated attack serving as the competitive benchmark.