Industry insights
Industry insights on DDoS, API security, acceleration and TLS.
Industry insights
26 articlesSelected industry events, security alerts and protection practices from May 2024 to October 2026, with historical events organized by event date.
2026
AI application security: control API resource use as well as attacks
Use OWASP resource-consumption risks to review account quotas, concurrency, timeouts and cost monitoring, and separate edge protection from application authorization.
Read moreEvaluating DDoS protection beyond bandwidth
Gbps, packet rate, connection counts and HTTP request rates describe different pressures. Combine them with traffic direction, legitimate bandwidth and origin health when evaluating protection.
Read moreDynamic acceleration: cache boundaries for authenticated pages and APIs
Accelerating dynamic workloads takes more than a high cache hit ratio. Separate public content from user data, then evaluate origin access, connection reuse and request latency without weakening account isolation.
Read morePage fetching and image proxies: SSRF beyond the public edge
A valid-looking request can trigger unsafe backend fetches. Review outbound access for proxies and converters.
Read moreTLS 1.3 0-RTT: check replay safety before optimizing latency
Evaluate handshake latency together with replay safety for payments, claims and write operations.
Read moreShorter TLS certificate lifetimes: what website teams should change in 2026
Publicly trusted TLS certificates now have a maximum lifetime of 200 days for new issuance. Review the next milestones and practical steps for inventory, renewal and multi-node deployment.
Read moreTLS Baseline Requirements 2.3.0 consolidate DNSSEC validation rules
SC100 consolidates validation requirements into a new section. Distinguish CA validation duties from your own DNS configuration.
Read moreQ4 2025 DDoS report: turn extreme records into drill questions
Use the report as threat context and turn it into concrete operational readiness checks.
Read moreSix-day and IP certificates become generally available
Let's Encrypt short-lived certificates last 160 hours. Verify ACME client support and renewal monitoring before adoption.
Read more2025
2025 Internet review: reading AI traffic, security and connectivity together
Cloudflare's annual review brings AI, connectivity, protocol adoption and security into a shared view.
Read moreQ3 2025 DDoS review: botnets and entry-point management
Changing attack devices make service inventory and origin access controls more important.
Read moreQ2 2025 DDoS observations: packet rate and business bandwidth
Assess packet processing, connection state and legitimate traffic independently.
Read more