Protectd: Evolving Vercel’s always-on denial-of-service mitigations

What this post added

Introduced Protectd, a next-generation real-time security engine that reduces DoS mitigation times by over tenfold. Protectd moves detection to the edge, replacing a polling-based design with real-time signal propagation. It uses Golang, a custom event-processing library, JIT and SIMD JSON serialization, virtualized time, and fast, probabilistic data structures to process ~550K events per second globally. New features include shadow mode for testing new rules, percentage-based rollouts, and historical traffic replay for backtesting. Since full rollout in January 2025, P99 time to mitigation is 3.5 seconds, P50 is 2.5 seconds, and response times can be as low as 0.5 seconds.