For network operators, ISPs and Telcos in the Baltics, DDoS risk is changing - and the biggest attack is not necessarily the most dangerous one.
Drawing on 12 months of DDoS data observed across RETN’s network, this presentation challenges the industry’s continued focus on peak attack size as the primary measure of threat. A 24.9 Tbps attack observed in November 2025 was almost nine times larger than any other monthly peak in the dataset - yet its size alone tells us little about the potential impact on a network or its customers.
This talk touches on how smaller, distributed and deliberately low-volume attacks can be more disruptive than record-breaking floods. Carpet-bombing, precision attacks and evolving attack techniques can target multiple prefixes, place pressure on network infrastructure or evade traditional detection thresholds without producing headline-grabbing traffic volumes.
For Baltic operators, the challenge is knowing what to look for and how to prepare. Andrejs will examine how the threat is evolving around the region, including risks from compromised network equipment and distributed attack sources, and why operators need to look beyond bandwidth - measuring detection speed, affected targets, root-cause clarity and the time it takes to understand and contain an attack.