A healthcare SaaS provider needed proof its patient portal would stay up under attack.
The challenge
A new hospital group contract included an uptime commitment with penalties. The client had bought CDN-based DDoS protection but had never seen it engage and could not say where the portal would break first.
What we did
After written authorization and notice to the CDN and hosting providers, traffic was ramped in stages during an overnight window with a live kill switch. Volumetric floods were absorbed at the edge as promised. An application-layer flood against the appointment search endpoint exhausted database connections at a fraction of the volumetric threshold.
The outcome
Rate limiting and caching were added to the search endpoint, connection pooling was fixed, and a runbook was written for the on-call team. A verification run the following week held at ten times the original failure point. The client used the capacity report in the contract negotiation.
Get the same answer for your systems.
One scoping call, a fixed-price proposal, and a written result you can show your board or your customers.