Cloudflare reports that 96% of its observed Q3 2026 network-layer attacks ended in under ten minutes. Useful input for an exercise plan; not a measurement of your outage duration or proof of application-layer attack prevalence.
The distinction worth testing is between filtering active and critical transactions working again. A short burst can leave connection pools, retries or queues impaired. Alternatively, traffic may have reached a bottleneck before filtering or bypassed the intended edge. Those explanations can coexist and need different fixes.
Start with a synchronized provider timeline and a synthetic login or write transaction, then examine origin and dependency telemetry. Do not infer a reliable recovery percentile from a handful of exercises. The article works through the evidence and renewal tradeoffs.