After assuming control of the infrastructure behind its Arbor CloudDDoS attack mitigation service, NetScout's first move has been doubling its capacity to keep up with AI-driven attacks.
NetScout markets a variety of network observability and security tools, including distributed-denial-of-service (DDoS) attack mitigation through its Arbor product line , which includes the Arbor Cloud hosted service and Arbor Edge on-premises device-level DDoS defenses.
During DDoS attacks, malicious actors use compromised computer systems to overwhelm networks with large amounts of traffic, resulting in a denial of service to users. These attacks have grown to monstrous size in the age of AI: the largest DDoS attack on record, by the Aisuru botnet in late 2025, topped out at 31.4 terabits per second (Tbps) of network traffic throughput.
DDoS attacks have also become more frequent, more variable and more sophisticated as AI makes mounting such attacks more accessible to less-skilled attackers, said Chris Steffen, an analyst at Enterprise Management Associates.
"Five years ago, building a botnet took real black hat skills," Steffen wrote in an email to TechTarget. "Now, pretty much anyone can rent an AI bot army that already knows how to dodge your defenses and is getting smarter by the day."
Shoring up the shield against AI DDoS attacks
In response, NetScout unveiled its new 33 Tbps capacity this week, up from a previous peak of 15 Tbps, achieved through investments in network switching and routing hardware and internet transit bandwidth for the cloud infrastructure it acquired from DigiCert Inc. for $55 million on May 1.
It gives us a leg up from a cost model perspective...But more importantly, it gives us the ability to do fast integration to continue improving defense mechanisms.
Carlos Morales, SVP & GM, Arbor Cloud, NetScout
Previously, NetScout controlled the software and services of Arbor Cloud, acquired as part of the company's $2.3 billion deal for Danaher Corporation's communications business in 2015, but a partner managed the infrastructure behind it. That infrastructure changed hands multiple times over the years, ultimately becoming part of DigiCert before NetScout moved to bring it in-house.
Taking control of the infrastructure rather than relying on a partner allowed NetScout to quickly enhance its capacity to absorb network traffic on behalf of customers through its Arbor Cloud service, said Carlos Morales, senior vice president and general manager of Arbor Cloud, in an interview with TechTarget.
"As one company, it gives us a leg up from a cost model perspective, because we're using our own devices and our own software," Morales said. "But more importantly, it gives us the ability to do fast integration to continue improving defense mechanisms."
By intercepting customers' traffic during a DDoS attack, Arbor Cloud can separate malicious traffic from normal traffic, and route the normal traffic back to the customer, a process called traffic scrubbing. The boosted capacity will help Arbor's traffic scrubbing service keep up with ever-growing AI DDoS attack volumes, Morales said.
John Grady
The move puts NetScouton a par with Akamai's 20 Tbps scrubbing capacity and inching closer to Cloudflare's globally distributed content delivery networks, which the vendor claims can bring 500 Tbps capacity to bear for DDoS mitigation.
"It’s a good amount of capacity they’re adding, so this puts them in the top tier in that regard," wrote John Grady, an analyst at Omdia, a division of Informa TechTarget, in an email this week. "Arbor was historically an on-premises, hardware-based company. So with this move they're prioritizing cloud mitigation capabilities, which are critical in today's environment of large, AI-generated attacks."
Beyond capacity: the next frontier for NetScout
Boosted traffic scrubbing capacity is important as attack volumes grow, but won't remain an advantage for long, according to Steffen.
"Capacity's table stakes now, not a differentiator -- 33 Tbps looks great until the next botnet clears it, which could be any second now," Steffen wrote. "What matters now is speed and precision -- catching an attack that changes mid-session, not just mid-campaign, and treating API traffic and AI agent behavior as a real attack surface, not an afterthought."
NetScout has also made moves to parry these aspects of AI DDoS attacks, including an Adaptive DDoS protection feature for its Arbor Threat Mitigation System introduced in February 2025. Taking over Arbor Cloud's infrastructure will increase the pace of further updates to Arbor Networks systems, Morales said, which will include deepening integrations between on-premises Arbor Edge and Arbor Cloud deployments.
"We're starting to blur the lines between on-premises and cloud capacity, and how the two can work together to protect customers," Morales said. "The DDoS landscape [requires] continuous improvement as new things come out. They're rarely novel, but the combinations of things are novel, and we're looking at other ways of making things faster, reply quicker and automate defenses as much as possible."
Beth Pariseau, senior news writer for Informa TechTarget, is an award-winning veteran of IT journalism. Have a tip? Email her or connect on LinkedIn.
John Grady
