A vendor-neutral, open standard for measuring DDoS resilience. One score, six components, fully transparent methodology.
Each component is scored 0-100 independently, then combined using fixed weights.
CDN deployment, WAF presence, origin protection, rate limiting, and vendor automation capability.
HTTP floods, Slowloris, cache bypass, API abuse resistance. Penalized for exposed GraphQL introspection, missing rate limiting, XMLRPC amplification vectors, and large uncacheable API surfaces. v1.1: L7 Attack Surface Assessment
SYN/UDP floods, amplification attacks, scrubbing center quality, and pipeline capacity.
HTTP/2 Rapid Reset, CONTINUATION Flood, QUIC Initial Flood, and protocol-specific CVEs.
Availability under attack, latency degradation, false positive rate, and recovery time.
JA3/JA4 fingerprint detection, slow-rate attacks, IP rotation handling, and behavioral analysis.
OPI accuracy depends on available data. Each tier is clearly labeled in reports.
| Tier | What it measures | Signal sources per component |
|---|---|---|
| OPI Passive | DNS, ASN, HTTP headers, cert transparency. Infrastructure coverage lower bound. No active probing. |
Defense Coverage: CDN/WAF via headers + cert SANs L3/L4 Resilience: scrubbing center via ASN, anycast routing Protocol Resilience: HTTP/2 + TLS config from headers L7 Resilience: exposed origin detection Operational: none (questionnaire/simulation required) Evasion: CDN coverage footprint only |
| OPI Estimated | Passive + L7 semi-active probe (API surface, GraphQL, rate limiting) + questionnaire answers. Pre-test estimate with attack surface penalties applied. |
Defense Coverage: adds WAF behavior from probe L3/L4 Resilience: adds on-demand scrubbing, ISP Arbor (questionnaire) L7 Resilience: rate limit stability from probe, GraphQL complexity Protocol Resilience: HTTP/3 QUIC, gRPC surface from probe Operational: TTM, runbooks, on-call SLA (questionnaire only) Evasion: adds vendor integration data if available |
| OPI Validated | Post active simulation. Measured availability, latency, error rates under real attack traffic. Authoritative score. |
Defense Coverage: validated by simulation outcomes L3/L4 Resilience: measured BGP divert time, scrubbing ramp-up latency L7 Resilience: rate limit stability under sustained load Protocol Resilience: measured QUIC/HTTP/2 multiplexing behavior Operational: actual TTR, kill-switch effectiveness (simulation) Evasion: whether protection holds with IP rotation + TLS fingerprint variance |
On-demand scrubbing contracts, ISP-native Arbor, and on-prem appliances are not passively detectable. Questionnaire answers lift detected scores toward the estimated upper bound. BGP divert activation time, rate limit stability under load, on-demand scrubbing ramp-up, and cross-vendor interaction can only be confirmed by simulation.
Not all protection architectures defend equally against all attack types. OPI v1.6.0 scores the underlying architecture class, not the vendor name.
| Architecture | Vol. L3/L4 |
Amplif. | Proto. abuse |
L7 App | Behav. evasion |
Slow rate |
Detectable by |
|---|---|---|---|---|---|---|---|
| Anycast DDoS-native Magic Transit, Prolexic Routed |
●●●● | ●●●● | ●●●○ | ●●○○ | ●●○○ | ●●○○ | Passive (ASN, anycast routing) |
| Anycast CDN Cloudflare, Akamai, AWS CloudFront |
●●●○ | ●●●○ | ●●●○ | ●●●● | ●●●○ | ●●●○ | Passive (cf-ray, x-amz-cf-id headers) |
| Cloud scrubbing behavioral Radware NSD, Netscout Arbor Cloud |
●●●○ | ●●●● | ●●●● | ●●●○ | ●●●● | ●●●● | ASN (on-demand: questionnaire) |
| Cloud scrubbing standard Lumen, Vercara, Neustar |
●●●○ | ●●●○ | ●●○○ | ●○○○ | ●○○○ | ●○○○ | ASN (on-demand: questionnaire) |
| Cloud WAF / L7 only Imperva, Barracuda WAF-as-a-Service |
○○○○ | ○○○○ | ○○○○ | ●●●● | ●●●○ | ●●●○ | Passive (x-iinfo, x-cdn headers) |
| On-prem ASIC behavioral Radware DefensePro, A10, FortiDDoS |
●●●○ | ●●●● | ●●●● | ●●●○ | ●●●● | ●●●○ | Questionnaire / vendor integration |
| On-prem FPGA Corero SmartWall |
●●●● | ●●●● | ●●●● | ●○○○ | ●○○○ | ●●○○ | Questionnaire / vendor integration |
| On-prem DDoS software Arbor APS, F5 BIG-IP AFM |
●●○○ | ●●●○ | ●●●○ | ●●●○ | ●●○○ | ●●●○ | Questionnaire / vendor integration |
| NGFW DoS policy Palo Alto, FortiGate, Check Point |
○○○○ | ○○○○ | ●○○○ | ●○○○ | ○○○○ | ●○○○ | Questionnaire only |
Filled dot = strength level (4=best, 0=none). Anycast architectures bypass the pipeline capacity cap; absorption happens at distributed PoPs, not at customer uplink. On-prem scores assume sufficient upstream link capacity.
The same vendor often ships products in different architecture classes. "We use Akamai" tells you nothing; it depends which product.
| Vendor | Product | Architecture Class | How OPI detects it |
|---|---|---|---|
| Akamai | CDN / Ion | anycast_cdn | Passive (ASN/CNAME) |
| Prolexic Routed | anycast_ddos_native | Questionnaire (BGP, invisible passively) | |
| App & API Protector | cloud_waf_l7 | Passive (challenge page) | |
| Cloudflare | CDN (Free/Pro/Business) | anycast_cdn | Passive (cf-ray header) |
| Magic Transit | anycast_ddos_native | Questionnaire (BGP) | |
| Spectrum | anycast_ddos_native | Questionnaire | |
| AWS | Shield Standard (free) | anycast_cdn | Passive (CloudFront / Route53) |
| Shield Advanced | anycast_cdn + DRT | Questionnaire (tier not passively visible) | |
| WAF | cloud_waf_l7 | Semi-active (challenge response) | |
| GCP | Cloud Armor Standard | cloud_waf_l7 | Passive (GFE headers) |
| Cloud Armor Enterprise (Adaptive) | cloud_waf_l7 + ML | Questionnaire (adaptive tier not visible) | |
| Azure | DDoS Basic (free) | anycast_cdn | Passive (MS network) |
| DDoS Network Protection | anycast_cdn | Questionnaire (SLA tier not passively visible) | |
| App Gateway WAF | cloud_waf_l7 | Semi-active | |
| F5 | BIG-IP LTM (load balance only) | none (no DDoS) | Questionnaire |
| BIG-IP AFM | onprem_ddos_software | Questionnaire / vendor integration | |
| Silverline (managed cloud) | cloud_scrubbing_behavioral | Passive (ASN) | |
| Radware | DefensePro (on-prem) | onprem_asic_behavioral | Questionnaire |
| Cloud DDoS / NSD | cloud_scrubbing_behavioral | Passive (ASN) | |
| Cloud WAF | cloud_waf_l7 | Passive | |
| Neustar / Vercara | UltraDDoS Protect | cloud_scrubbing_standard | Passive (ASN) |
| Gcore | DDoS Protection | cloud_scrubbing_standard | Passive |
| CDN | anycast_cdn | Passive | |
| Imperva | Cloud WAF | cloud_waf_l7 | Passive |
| Network DDoS Protection | cloud_scrubbing_standard | Questionnaire | |
| Check Point | DDoS Protector | onprem_asic_behavioral | Questionnaire (rebadged Radware DefensePro) |
| Fortinet | FortiDDoS (dedicated ASIC) | onprem_asic_behavioral | Questionnaire |
| FortiGate DoS Policy | ngfw_dospolicy | Questionnaire |
The premium tier often changes the architecture class, not just the score within it. Cloudflare Magic Transit vs. Cloudflare CDN are different products with different mitigation profiles, from the same vendor. This is why OPI asks which product, not which vendor.
Two networks can both be anycast_cdn and absorb volumetric floods at the edge, yet differ sharply in how fast they share state between points of presence. OPI tags each anycast vendor by mesh topology because that difference decides how easily an attacker evades behavioral defenses and bypasses rate limits.
The rate-limit side of this effect is already in the counting-architecture penalty (per-PoP vs per-edge vs per-server); the mesh tag adds the behavioral side. Neither is a verdict on network quality, only on cross-PoP state convergence under a distributed attack.
Define your infrastructure to compute an OPI score using the same engine as DDactic scans.
| Score | Grade | Classification |
|---|---|---|
| 90 - 100 | A | Excellent - Enterprise-grade protection |
| 80 - 89 | B | Good - Solid defenses with minor gaps |
| 70 - 79 | C | Adequate - Basic protection, some risks |
| 60 - 69 | D | Poor - Major vulnerabilities present |
| 0 - 59 | F | Critical - Minimal to no protection |
Display your OPI score in READMEs, reports, and dashboards.
-16a34a){kind=icon}
Grade A
-2563eb){kind=icon}
Grade B
-d97706){kind=icon}
Grade C
-ea580c){kind=icon}
Grade D
-dc2626){kind=icon}
Grade F
Markdown
HTML