Protectd: Evolving Vercel’s always-on denial-of-service mitigations
By Steven Van ·
Protectd runs on all Vercel deployments and detects attacks at the edge, replacing a polling pipeline that could take over 20 seconds to respond.
Vercel has added Protectd, a real-time security engine that runs across all deployments and cuts mitigation times for novel DoS attacks by over tenfold. The announcement describes it as an extension of the Vercel Firewall.
The old pipeline needed more than 20 seconds to mitigate some application-layer attacks. It relied on network events materialised in a global ClickHouse cluster, which regions polled for new signatures. About 85% of all L7 protections depend on that pipeline. Vercel says its infrastructure absorbs L7 floods easily, but prolonged attacks risk overwhelming customer backends and generating unwanted usage.
Protectd moves detection to the edge. It runs in every region and takes enriched network events over persistent TCP connections from the existing FluentBit forwarders, so nothing waits on polling. When it spots a suspicious pattern, it pushes a defensive signature to the event bus in the same region, and the TLS terminators enforce it.
- It maps relationships between traffic attributes, such as TLS fingerprints tied to User-Agent strings, ASN and IP reputation, and unusual request flows.
- It is written in Go and processes about 550K events per second globally on 14 CPU cores.
- New filters start in shadow mode, where they flag traffic without blocking it, so false positives can be measured first.
- Rules can roll out by percentage, and Protectd records every processed event so past attacks can be replayed against new mitigations in a sandbox.
ClickHouse stays in place for long-term traffic analysis.