Cloudflare and Kentik join forces for on-demand DDoS defense

Cloudflare has announced the general availability of an integrated offering combining its Magic Transit DDoS mitigation service with Kentik's network observability platform. The move is designed to remove friction for network security teams that want flow-based monitoring to drive on-demand DDoS protection, letting them procure both capabilities under a single vendor agreement.

Why monitoring matters for mitigation

DDoS attacks continue to escalate in both frequency and severity. Cloudflare's threat data from 2021 highlighted ransomware-driven campaigns targeting critical infrastructure such as oil pipelines, healthcare, and financial services, alongside the emergence of the Meris botnet and record-breaking multi-terabit network-layer assaults. Meanwhile, the rise of cheap, automated attack toolkits has made manual detection and response impractical for most organizations.

That reality has pushed defensive strategies away from on-premises appliances and hybrid models toward fully Internet-native protection. For always-on availability, defenders also need baselines of what normal traffic looks like. Flow-based network observability gives engineers visibility into traffic volume, sources, destinations, and which applications are consuming bandwidth — data that is essential for distinguishing routine load from a sustained attack.

Cloudflare's Magic Transit is designed to protect entire IP subnets from DDoS attacks while accelerating legitimate traffic. It operates across a global network spanning over 250 cities with 121 Tbps of capacity, and it can run in always-on or on-demand modes so that customers activate protection precisely when an attack occurs.

Three deployment models

Cloudflare says the Kentik partnership lets customers choose from three ways to consume Magic Transit:

  • Always On — Magic Transit is deployed permanently for fast mitigation alongside traffic acceleration.
  • On Demand — Customers activate Magic Transit in response to an attack through the Cloudflare UI or the Magic Transit API.
  • On Demand + Flow-based Monitoring — An integrated package combining Magic Transit On Demand with Kentik Protect, procured from a single vendor.

All configurations remain paired with Magic Firewall, Cloudflare's cloud-native firewall-as-a-service.

How the integration works

The partnership stems from customer feedback that revealed a common pattern: many Magic Transit On Demand users already relied on Kentik for traffic observability. Kentik's cloud platform ingests flow logs from network infrastructure and uses machine learning to establish behavioral baselines and detect anomalies such as DDoS attacks.

With the native API integration, Kentik can trigger Magic Transit to begin attracting traffic when an attack is detected. Cloudflare's autonomous edge mitigation then analyzes incoming packets and filters malicious traffic across the full network, shoring up availability before service degradation becomes visible to end users.

The result, per both vendors, is a fully SaaS-based defense package: Kentik provides best-of-breed visibility and detection, while Cloudflare supplies industry-leading DDoS mitigation without requiring hardware or complex routing changes.

"We are excited to partner with Cloudflare to make it easier for our mutual customers to integrate our leading technology solutions and deploy industry-leading DDoS protection in a fully SaaS-based environment", said Mike Mooney, CRO at Kentik.

Additional details on the joint solution are available in Cloudflare's developer documentation, and the two companies have scheduled a joint webinar to walk through DDoS trends and the combined architecture.