Dedicated DDoS defense since 2006
Automatic DDoS Mitigation Without the Operational Overhead
RioRey builds systems that stop distributed denial of service (DDoS) attacks while keeping legitimate traffic flowing. One engine runs on hardware, virtual machines, cloud scrubbing and hybrid deployments.
Prefer to read offline or pass this along to your team? The same overview is available as a two-page PDF.
RioRey at a glance
- Founded on a single problem: DDoS is all we do
- 2006
- Attack classes in the RioRey Taxonomy, Layer 3 to Layer 7
- 25
- Typical time to detect and mitigate, with no learning period
- 0 to 90sec
- Mitigation capacity, from a 1G rVM to rCloud scrubbing
- 1G to 5Tbps
What Makes RioRey Different
Four things that have been true since day one, and still shape every product we build.
-
Built for One Problem
RioRey has worked only on DDoS since 2006. It is the whole product, not a feature added to a firewall, router or load balancer.
-
No Signatures, No Rules, No Baselines
Protection starts minutes after power-up. There is nothing to train, tune or update before RIOS can filter an attack.
-
Not a Black Box
Every deployment, including rCloud, comes with rWeb: real-time visibility and direct mitigation control, without opening a support ticket.
-
Pricing in Public
We publish rVM and rCloud pricing, so you know what protection costs before you talk to anyone.
Methodology
How RIOS Detects Attacks
We Focus on the Constant, Not the Variable
Attack tools change all the time. Their names, signatures and botnets turn over quickly, and often on purpose. Vendors that track tools, signatures or infected hosts are tracking the variable, so they are always one step behind.
The method an attack has to use to succeed changes far less. RioRey grouped those methods into the RioRey Taxonomy of DDoS Attacks, 25 classes across TCP, TCP-HTTP, UDP and ICMP. RIOS, our mitigation software, uses analytics built on that taxonomy. It looks at protocol behavior, traffic characteristics and attack technique, then drops attack packets and lets legitimate ones through.
A new attack tool is not a zero-day for RioRey. It is a new variation on a method RIOS already covers, and it is usually blocked from day one.
Why Add-On Defenses Fall Short
- Manual mitigation does not scale. Adding bandwidth and engineers is slow and expensive, and it fails at 2am.
- Bolted-on DDoS features in general-purpose equipment get overrun by large floods and outmaneuvered by low-and-slow and Layer 7 attacks.
- Baseline and anomaly detection breaks down in busy, changing networks where "normal" never holds still.
- False positives are outages too. Blocking real users does as much damage as the attack. RIOS is designed to keep good traffic flowing during heavy attacks.
What a dedicated, clean-sheet design changes
-
Methodology by design
RIOS was designed from scratch for DDoS, with automation as a core requirement. Methodology-driven detection cannot be bolted onto a general-purpose platform.
-
Lower operating cost
No tuning, signature updates or manual intervention during attacks. Fewer specialist staff, less training, and the same protection whoever is on call.
-
Protection as a service
ISPs and hosters get back the engineering time that DDoS used to consume, and can sell the same protection to their customers through multi-tenant rWeb.
Platform and deployment
One Engine, Every Deployment
Every platform runs RIOS, covers all 25 attack classes and is managed through rWeb. Only capacity and deployment change.
| Platform | Capacity | How it deploys | Best fit |
|---|---|---|---|
| Hardware appliances: purchase or subscription | |||
| RE101U | 1 x 10G SFP+, up to 6M pps | In-line or off-ramp, integrated hardware bypass | A single 10G edge link |
| RS402U, full HA | Up to 4 x 10G pairs, up to 40M pps, licensed one pair at a time | In-line or off-ramp, bypass on every interface, redundant power and fans | Several 10G links where uptime is critical |
| RE1101U | 1 x QSFP28 (40G or 100G), up to 133M pps. RE110-20 and RE110-40 are license-upgradable to full RE110 throughput | In-line or off-ramp, optional external optical bypass | Provider-class 40G and 100G edges |
| Virtual and cloud: subscription | |||
| rVMKVM, VMware ESXi | 1G to 100G per instance (up to 50M pps), no limit on parallel instances | On your own servers, dedicated NIC in PCI passthrough | 1G links, virtualized edges, MSSPs that want no capex |
| rCloudCloud scrubbing | Up to 5 Tbps of attack bandwidth, scrubbing centers in Europe and the US | BGP redirection of your /24, clean traffic returned over GRE or direct connect | Attacks larger than your edge, for any network that controls a /24 |
| DirectorVM | Sized from 10G to 400G of inspected traffic, custom above that | Detects attacks from NetFlow and sFlow, steers traffic using BGP, RTBH or FlowSpec | Off-ramp scrubbing centers and hybrid deployments |
Visibility, control and the single-vendor hybrid
See Every Attack, From Edge to Cloud
The same portal, the same zones and the same engine wherever traffic is filtered.
rWeb: See It, Control It, Sell It
- Live and historical traffic by zone and attack class.
- Per-zone control: Auto, Monitor or Bypass per attack class.
- Multi-tenant, with a branded client portal for resale.
Hybrid: Edge Speed, Cloud Scale
Edge capacity always has a limit. Cloud-only protection adds latency and cost for attacks you could stop locally. A RioRey hybrid gives you both, from one vendor.
- RIOS at your edge filters every attack it can absorb, in-line and immediately.
- When an attack crosses the threshold you set for that zone, Director moves the traffic to rCloud.
- rCloud scrubs it with the same RIOS analytics and returns clean traffic. Director moves it back when the attack ends.
One engine, one rWeb portal, one set of zones and one support team, from edge to cloud. Mixing vendors means two detection models, two dashboards and gaps in between.
You will never find yourself between vendors.
Who We Serve
- ISPs and service providers: protect the network, then sell protection.
- Hosting and cloud providers: a branded portal for every tenant.
- Enterprises that run their own edge without a DDoS team.
- Government: lean teams, hardware by subscription.
- MSSPs: managed DDoS on rVM and rCloud, with no capex.
- Any network with a /24: large-scale scrubbing through rCloud.
Share This Overview
The same content as a two-page PDF, ready to pass along to your team.