The dominant pattern in this week's attack news is not that one kind of assault is surging or fading. It is that attackers are reshaping their craft. Cloudflare's newest threat intelligence shows the headline numbers moving in opposite directions, while Dell and Microsoft are both pushing defenses toward the systems that decide who gets in and how fast an organization can get back up.
A Volume Story With a Different Shape
Cloudflare's Cloudforce One unit reported today that network-layer attacks more than tripled from a year earlier, reaching 18.2 million, even as the very largest distributed denial-of-service attacks fell nearly 69% in the third quarter. Buried in the Cloudflare DDoS Threat Report 2026 Q3, as SiliconANGLE reported, is a further detail: 251 attacks exceeded 1 terabit.
Those figures do not contradict one another, but they do undercut the instinct to read headline DDoS totals as a simple danger gauge. A smaller number of record-setting floods and a much larger number of ordinary ones describe different attacker behaviors. The report's two directions suggest that the ceiling of raw bandwidth may matter less to many operators than the floor: the steady, high-frequency pressure that keeps networks and their defenders busy.
For US technology companies, that reframing has operational consequences. Procurement and board reporting often track the largest observed attacks, because those are legible and dramatic. The Cloudflare data implies the more common risk is accumulation, not spectacle.
What Falling Megabit Peaks Could Mean
A 69% drop in the biggest attacks during a single quarter is the kind of number that can be misread as progress. The report does not explain the decline, and it should not be treated as evidence that the threat has receded, especially alongside a 208% rise in total attacks.
One plausible reading, consistent with the numbers but not established by them, is that the economics of assembling very large floods have changed while smaller, cheaper campaigns have become more accessible. Another is that measurement and mitigation are simply catching more of the smaller events. The material does not settle that question, and US security teams would be unwise to treat the megabit decline as a victory.
What is supportable is narrower: attack counts are climbing fast while the top of the distribution is thinning. For American cloud, hosting and network operators, that argues for capacity planning and mitigation tuning that assume frequent, modest assaults rather than rare, enormous ones.
Identity Moves to the Center of Attack Surface
The second thread in the logged stories concerns where attackers and defenders are now concentrating. Dell Technologies is extending its cyber recovery tools to cover identity systems, as SiliconANGLE reported, putting identity resilience alongside data protection. The company's stated rationale is that restoring data is insufficient if the identity systems controlling access have also been compromised.
That is a direct statement about the attack beat. It suggests that recovery planning built around backups alone leaves a gap: an organization can restore files and still be unable to trust who is logging in. As AI ties data, identity, infrastructure and applications into interdependent systems, per SiliconANGLE, the boundary between restoring data and restoring trust narrows.
Microsoft's message to Entra ID administrators runs along the same track. BleepingComputer reported that Microsoft again asked admins to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027. The deadline is more than a year out, but the repeated urging signals that adoption is lagging the vendor's timetable.
