NetScout Systems. Inc. - Experts & Thought Leaders

NETSCOUT® SYSTEMS, INC. released its first half 2026 Distributed denial-of-service (DDoS) Threat Intelligence Report, revealing a significant shift in how attacks are launched and sourced. With more than 9.1 million DDoS attacks recorded globally by NETSCOUT between January and June 2026, the report highlights that DDoS risk is growing along three axes: the volume of traffic that must be inspected, the number of places where mitigation must be deployed, and the share of attacks that disrupt service without ever saturating a link. “The 1,286 percent rise in attacks clearing 1Tbps or 1Gpps means high-capacity events are no longer anomalies; they are routine,” stated Hardik Modi, VP Engineering, DDoS solutions, and ASERT Threat Intelligence Team, NETSCOUT. “With the proliferation of residential proxies and short, rate-based attacks from DDoS-for-hire platforms, traditional coarse network controls are insufficient. Providers and enterprises alike need finer-grained, selective mitigation and increased scrubbing capacity at network edges to combat these qualitative shifts in attack sophistication.” Expanding operational risk Key findings include: Massive attacks on a global scale – NETSCOUT ATLAS recorded more than 9.1 million DDoS attacks across 209 countries and territories, underscoring the expanding operational risk to enterprises and providers Surge in high-impact capacity – attacks exceeding 1Tbps or 1Gpps increased 1,286 percent year-over-year, suggesting defenders must continue to prepare for greater attack intensity IPv6 crossed the terabit threshold – NETSCOUT observed its first IPv6 attack exceeding 1Tbps, while active mitigation of IPv6 attacks rose by more than 300 percent year-over-year even as IPv6’s share of attacks remained roughly flat, illustrating the need for robust IPv6 protection Pressure on carrier mitigation – direct-path methods accounted for 64 percent of observed attacks and gained share for a third consecutive half-year, while carpet-bombing grew from 3.97 percent to 4.54 percent of attacks, and outbound attacks clearing 1Tbps/1Gpps caused operational impacts. Dedicated mitigation capacity remains the selective layer that providers need to intelligently filter malicious traffic DDoS-for-hire and attack economics – attacks lasting one minute or less have roughly doubled as a share since 2H 2023, stressing connection tables, application backends, and resolvers, suggesting DDoS-for-hire platforms are shortening the path to attack Residential proxy supply chain – by pairing residential proxy network tracking with DDoS telemetry, NETSCOUT ASERT identified residential proxy sources participating in DDoS attacks, highlighting that attack traffic can originate from harder-to-distinguish consumer IP addresses Composite peak values NETSCOUT maps the DDoS landscape through passive, active, and reactive vantage points, providing unparalleled visibility into global attack trends. For more than 15 years, NETSCOUT has delivered trusted, consistent DDoS Intelligence based exclusively on directly observed, verifiable attack traffic. NETSCOUT does not aggregate multiple alerts or geographically distributed events into composite peak values, which ensures accuracy, repeatability, and true comparability across reporting periods. Peak metrics reflect single-second maximum bits-per-second (bps) and packets-per-second (pps) rates measured at defined mitigation and monitoring points. Overwhelm critical services NETSCOUT protects two-thirds of the routed IPv4 space, securing network edges that carried global peak traffic of over 800 Tbps. It monitors tens of thousands of daily DDoS attacks by tracking multiple botnets and DDoS-for-hire services that leverage millions of abused or compromised devices. NETSCOUT ARBOR Cloud, backed by ATLAS visibility and dedicated DDoS mitigation capacity, complements on-premises defences and helps organisations absorb large, distributed attacks before they overwhelm critical services. These findings show why DDoS resilience now depends on more than stopping the largest attack. Organisations need to recognise changing attack sources and methods, mitigate both inbound and outbound attacks, apply precise protection where services are exposed, and draw on cloud capacity when attacks exceed local defences. NETSCOUT combines directly observed ATLAS intelligence with on-premises and cloud-delivered mitigation to help customers protect service availability and sustain the digital operations their businesses depend on.

NETSCOUT, a provider of network observability, AIOps, cybersecurity, and DDoS attack protection solutions, announces nGenius® Copilot, an AI-powered conversational extension to nGeniusONE® that provides intuitive access to NETSCOUT® Smart Data. It gives more people access to Smart Data for easier and faster ways to investigate service disruptions and assess business impact. nGenius Copilot is grounded in NETSCOUT Smart Data, the high-fidelity, contextual data derived from observed network, application, service, and user interactions. By transforming natural language questions into evidence-based answers, relevant visualisations, supporting evidence, and suggested follow-up inquiries, it helps experienced engineers accelerate complex investigations while enabling a broader range of professionals to benefit from advanced operational intelligence. Advanced operational intelligence As hybrid environments and digital dependencies become more complex, resolving service disruptions requires IT teams to interpret growing volumes of operational data and connect evidence across applications, infrastructure, networks, and external services. nGenius Copilot simplifies that process, transforming natural-language questions into clear, evidence-based answers grounded in NETSCOUT Smart Data, helping more members of an organisation identify contributing conditions, assess business impact, and act faster. “Reliable AI starts with reliable data,” said Phil Gray, AVP, product management, NETSCOUT. “nGenius Copilot combines an intuitive conversational experience with the depth and context of NETSCOUT Smart Data. It helps teams quickly uncover relevant evidence, understand contributing conditions and business impact, and collaborate around a consistent view of what occurred. Ultimately, it enables customers to realise greater value from the NETSCOUT intelligence they already have.” Natural-language questions Simple direct questions can be asked, such as: which applications are responding slowly or experiencing increased latency? Which users, locations, or services are affected? What network, application, server, or external conditions may be contributing to the problem? nGenius Copilot interprets the question, applies the relevant Smart Data, and presents the resulting analysis in clear language with visual context and supporting evidence. nGenius Copilot is available for purchase now and helps organisations: Accelerate problem identification: Guide investigations from an initial symptom to the applications, services, network conditions, and dependencies contributing to the issue Prioritise business impact: Show which users, locations, services, and transactions are affected so teams can focus resources where they matter most Scale operational expertise: Make Smart Data accessible through natural-language questions, guided analysis, and clear explanations while helping senior engineers investigate complex problems more efficiently Improve cross-team collaboration: Translate detailed technical evidence into clear explanations and visualisations that network, application, infrastructure, service, and business teams can use together Enhance the value of NETSCOUT deployments: Bring Smart Data directly into everyday workflows and enable more professionals to benefit from the data their organisations already collect nGenius Copilot supports NETSCOUT’s commitment to make its packet-derived Smart Data more accessible and easier to use where operational decisions are made. It lets people ask questions in natural language, examine supporting evidence, and identify the conditions affecting services and users. For customers, that means a faster path from disruption to resolution. For NETSCOUT, it extends the value of its data into AI-assisted operations.

NETSCOUT SYSTEMS, INC., a provider of observability, AIOps, cybersecurity, and DDoS attack protection solutions, announces Model Context Protocol (MCP) connectivity for its Omnis™ AI Insights solution. The new capability gives AI assistants and agents on-demand access to AI-ready Smart Data, NETSCOUT’s real-time operational evidence, providing the trusted context they need to support more accurate and informed decisions. AI-ready Smart Data builds on NETSCOUT’s patented Adaptive Service Intelligence™ (ASI) technology, using granular data to provide a richer, more scalable source of contextual network intelligence. Enabling network infrastructure NETSCOUT performs early semantic extraction and context optimisation at source, transforming ASI data into compact, AI-ready Smart Data before it enters downstream systems. Omnis Sensor and Omnis Streamer are key components of NETSCOUT’s Omnis AI Insights solution, moving intelligence closer to the source of the data and enabling network infrastructure to evolve from simply producing telemetry to delivering contextual, AI-ready network intelligence. Omnis Sensor performs early semantic extraction at critical network vantage points to represent application, service, transaction, and behavioural context within ASI in real time at the source. It generates essential metadata while preserving operational meaning at the point of observation. This compact, high-fidelity evidence gives AI models trusted operational context for more accurate, efficient, and explainable decisions Omnis Streamer collects and curates AI-Ready Smart Data for downstream use. Customisable playbooks shape the data for any domain, operational requirement or use case, with healthcare, financial services, and telecommunications service provider environments among the available templates. It delivers those datasets through platform integrations or on demand to AI assistants and agents through its new, built-in MCP server Increasingly autonomous operations Enriching network data before it reaches an AI model reduces the volume, cost, and complexity of processing raw telemetry while giving AIOps, observability, security, and analytics systems more meaningful evidence for faster, more reliable decisions and increasingly autonomous operations. Omnis AI Insights provides organisations with a ground truth, evidentiary view of operations that AI agents and assistants require for trusted autonomous action: On-demand access for AI: MCP connectivity gives AI assistants, AI models, and agents relevant AI-Ready Smart Data at run time. NETSCOUT-provided tools guide them to the evidence that matters and help them interpret it Direct platform integration: Ingestion of Smart Data via integration by Splunk (https://www.netscout.com/technology-partners/splunk), ELK Stack, Datadog, ServiceNow (https://www.netscout.com/technology-partners/servicenow), Dynatrace and others Investment protection: Omnis Sensor Adaptors help customers add these capabilities to their existing NETSCOUT infrastructure Application monitoring tools “Everyone knows there is no value to conclusions that cannot be trusted,” said Phil Gray, AVP, product management, NETSCOUT. “By adding MCP tools alongside our existing Kafka streaming capabilities, Omnis AI Insights gives IT professionals the flexibility to feed AI-ready Smart Data into analytics and AI platforms at scale and cost effectively, while also making that same context-rich intelligence directly accessible to Models and Agents. This helps organisations power AI with a compact, curated, trusted source of network truth rather than fragmented operational signals that suffer from hallucinations and high token spends.” In a live NETSCOUT deployment, conventional application monitoring tools indicated no application errors and nothing to investigate, while underlying network conditions degraded the user experience. NETSCOUT Smart Data preserved exactly what happened across the network, including the minimum window size, total retransmit count, and zero-window event count, allowing AI to verify facts rather than infer reality. Governed autonomous operations NETSCOUT AI-ready Smart Data helps customers reach accurate answers faster, reduce token and infrastructure costs, and advance toward governed autonomous operations with greater confidence. It also extends the value of existing NETSCOUT investments while providing a differentiated data foundation for future AI innovation. These new capabilities in the Omnis AI Insights solution put trusted operational context to work across AI, analytics, observability, service assurance, security, and data lake environments without re-platforming or building new data pipelines.