Vercel security roundup: Faster defenses and better visibility for your apps
By Steven Van ·
Vercel reports DDoS protection 40x faster, new firewall alerts and SIEM streaming for Enterprise, plus a PCI DSS v4.0 attestation.
Vercel's quarterly security roundup puts a number on the last three months of 2024: its WAF automatically mitigated 87 billion attacks from 19 million unique IPs. The post also lists the firewall, alerting and compliance changes shipped over the same period.
- DDoS protection is now 40x faster, using real-time stream processing to block malicious traffic earlier.
- The WAF now returns a 403 Forbidden response for persistent threats, so enforcement is clearer to end users.
- DDoS mitigation notifications alert teams when the Vercel Firewall detects and automatically mitigates an attack on a project.
- The Project Overview page previews a project's Firewall status and other information from the past 24 hours.
- The Monitoring or Observability Plus tab has more granular Firewall data. Blocked requests can be filtered by action, with details such as IP country and user agent.
- Enterprise customers can configure a real-time audit log stream to SIEM tools such as Datadog or Splunk.
- Vercel completed its SAQ-D AOC for Service Providers under PCI DSS v4.0.
Of the blocked requests, 22 billion came from the US (3.6 million unique IPs), 16 billion from Germany and 13 billion from Singapore. Layer 3 and Layer 4 protection against DDoS and TCP-based attacks is enabled for every customer on any plan tier.
Vercel's CISO, Ty Sbano, names three challenges for the coming year: more intense DDoS attacks, more sophisticated bots as AI and agent traffic grows, and the need for human tuning of business logic, which the post calls "Layer 8". Vercel will be at RSAC 2025 in April, and customers with a security story can apply to speak at Vercel Ship in NYC in June.