Zayo released its 2026 Cybersecurity Insights Report. Based on analysis of global network traffic in 2025, the report revealed a sharp escalation in the scale and focus of Distributed Denial of Service (DDoS) attacks, with attackers increasingly shifting aim beyond telecommunications to strike enterprises and other critical organisations directly. While total attack volume fell slightly below the record highs of 2024, organisations are still experiencing an all-time, sustained high of attack frequency, signalling that DDoS is becoming a defining feature of today’s threat environment.
“The rise in AI, IoT devices, and for-hire botnets has led us into a new era, where DDoS attacks are a permanent and highly disruptive reality for all organisations – from manufacturers and retailers to schools and governments,” explains Max Clauson, SVP of Network Connectivity at Zayo. “In this ‘new normal,’ cybersecurity can no longer operate as a standalone, reactive function. If organisations fail to prepare, they risk costly disruptions that can halt operations, delay services, and cascade rapidly across partners, customers, and critical systems.”
DDoS threat broadens to more sectors
As organisations race to automate and scale, adversarial actors are evolving alongside them, shifting from brute-force noise to tactical, destructive strikes. The report found that the average attack size increased almost 70% from the year prior, while the average duration decreased to 20 minutes, down from 39 minutes the previous year. In fact, 89% of attacks now conclude in under 10 minutes. As attacks grow more precise, intense and harder to detect, real-time automated defence is increasingly essential to safeguard critical connectivity.
The report also found that the primary targets of attacks have shifted. DDoS campaigns have historically targeted telecommunications and network providers, with attacks on central traffic hubs capable of triggering widespread downstream disruption. Now, telecoms accounts for just 24% DDoS attacks in 2025, down from 42% in 2024. In return, end-user industries – enterprises, education, and the public sector – have moved further into the crosshairs, where downtime quickly turns into real operational, financial, or reputational impact.
Industry level trends and insights
The report identified key trends across industries:
Education accounted for 24% of total DDoS attacks in 2025, up from 15% the prior year, with more than 45% of attacks occurring in April and May during peak academic periods. Attack timing suggests intentional disruption, targeting networks when they’re most vital and exploiting limited security resources.
Manufacturing experienced an average attack size of 11.6Gbps, the largest across all industries. In automation-heavy environments, even short bursts at this scale can halt production lines and create outsized operational losses.
Government’s share of total attacks increased from 5% to 12% year-over-year, with an average attack size of 5.5Gbps. The rise in both frequency and scale indicates DDoS is increasingly being used as a strategic disruption tool against public-facing digital infrastructure.
Why it matters
As end-user organisations themselves increasingly come under fire, the stakes for multi-layered cybersecurity continue to rise. In an environment where attacks are faster, more automated, and designed to disrupt operations in minutes, resilience must be built into the network itself, requiring organisations to think strategically about how their infrastructure detects, absorbs, and responds to disruption.
