Arbor Networks saw the traffic jam coming

Imagine a bank with an excellent lock and a crowd blocking every road to the entrance. Nobody has picked the lock. Nobody needs to. The bank is unavailable. Distributed denial-of-service attacks exploit a similar problem online: overwhelm the path, the equipment or the application until legitimate customers cannot get through. Arbor Networks made this awkward distinction its business.

01 / A network has a rush hour

Arbor’s starting point was the network itself. At the University of Michigan, Farnam Jahanian and Rob Malan studied traffic volumes, origins and destinations. Unusual patterns could reveal trouble. They founded Arbor in 2000. Even the name carried the campus connection: Ann Arbor.

Today, under NETSCOUT, that habit survives in Arbor Sightline. It combines network telemetry with routing context to help operators understand what is crossing their infrastructure. A surge becomes something to investigate: which customers, destinations and paths account for it? The same visibility supports decisions about capacity, transit costs and network interconnections.

That is a useful commercial detail. The person buying attack detection also has an ordinary Tuesday to manage. Network equipment must earn its place when nobody is attacking. Sightline can help an operator plan growth or examine expensive traffic patterns as well as recognize a flood.

02 / The researchers needed a sales department

The early obstacle was organizational. Corporate research contacts opened doors to strategic investors, but the founders still needed a lead investor willing to provide governance. Battery Ventures filled that role. Hiring followed. Malan recalled wondering what a vice president of sales actually did.

“We had no idea what we were in for.”

Rob Malan, recalling Arbor’s beginnings

By August 2002, Arbor announced a $22 million Series B led by Thomas Weisel Venture Partners, bringing total funding to $33 million. Turning an observation into infrastructure software required a company around it. The lesson for a technical founder is pleasantly unromantic: recruit people who understand the work you have never done.

03 / Move the fight upstream

Seeing an attack and absorbing one are separate jobs. Arbor divides them among products. Sightline detects and coordinates. The Threat Mitigation System, or TMS, scrubs malicious traffic. Arbor Edge Defense sits between an internet router and firewall, filtering incoming attacks and blocking known malicious communications, including traffic leaving compromised devices.

Placement matters. A firewall keeps track of connections; attacks can exhaust that tracking capacity. Edge Defense uses stateless processing, which avoids maintaining that same kind of connection table. But even a capable local filter cannot create bandwidth on an upstream circuit that attack traffic has already saturated.

Arbor Cloud supplies another place to intervene. Traffic can be diverted through scrubbing centers using internet routing or DNS, then returned after filtering. Cloud signaling connects local protection to that upstream response. Shorter, smaller attacks can be handled near the customer; floods too large for the access link need attention before they reach it.

The updated Arbor Cloud product page lists 33 terabits per second of mitigation capacity across 16 centers. NETSCOUT announced the expansion in July 2026. That is aggregate network capacity, a useful measure of the service’s scale. A buyer still needs to examine the protection and commitments applying to their particular deployment.

04 / The customers become the lookout

Arbor’s other asset is a view beyond any individual customer’s network. ATLAS collects observations from participating operators. ASERT researchers investigate threats, while the ATLAS Intelligence Feed supplies intelligence to the defenses. NETSCOUT describes visibility into more than 800 Tbps of internet traffic. Visibility and mitigation capacity measure different things; one observes, the other filters.

The appeal is straightforward: an operator may encounter a pattern that someone else has already seen. Shared observations can help turn a local surprise into a recognizable event. The data-sharing program also deserves attention during procurement. Customers should understand what information they contribute and how it is handled.

For a reader who wants to see the threat landscape without buying appliances, NETSCOUT offers Cyber Threat Horizon, a free portal showing DDoS activity. For a network team, the more consequential question is whether the intelligence reaches the controls that can act on it.

05 / Buying time, selling availability

Customers include service providers, mobile operators and enterprises. Vodafone is a documented example: a NETSCOUT-sponsored 2022 publication describes Arbor protecting its internet network and many local-market networks. Providers can also use Sightline and TMS to build managed DDoS services. Security becomes a product they sell, alongside a defense they operate.

The revenue model spans equipment, software, support, intelligence subscriptions and managed cloud services. A useful buying comparison therefore includes the people and processes around the purchase: monitoring, escalation, routing changes and testing. An appliance price alone cannot describe that operating arrangement. Ask for a deployment-specific quote and a demonstration using your network’s constraints.

Arbor competes with vendors including Akamai, Cloudflare, Radware and Corero. Its particular pitch combines the operator’s network view with several mitigation locations. The fit depends on what needs protecting. A team must supply usable telemetry, arrange traffic diversion where required and rehearse the response. Local protection alone cannot solve an oversized upstream flood.

Arbor joined NETSCOUT in 2015 through a $2.3 billion acquisition of Danaher’s Communications Business, a transaction covering several businesses. The company’s practical lesson travels well beyond security: learn the normal pattern, locate the bottleneck, and put the intervention where it can still change the outcome. A better lock is useful. So is keeping the road open.