Even without that, I wouldn’t be surprised if it’s covered by other forms of insurance, such as policies that would cover an internet or power outage. It would probably be harder to get the insurance to pay out, but if your legal team is big enough, maybe...
These days incident response retainers are very common, where you would pay a security firm like Mandient or Verizon or IBM a small fee every month and in exchange they guarantee that they will have an expert on site within X hours if you have a security breach. Almost every major company has a retainer like this.
The real benefit to this situation is you get to avoid haggling over price and waiting for a quote from the sales guy and running it past your legal department. All that enterprise sales nonsense is already done so when you pick up the phone it's all business with no negotiation.
Standard: free; only pay AWS egress charges. Advanced: $3K/yr + ~$0.05/GB data out
So blocking 3Tbps costs nothing additional to the user.
So your account is all active, but you don't have the proxy-through-CF part.
As a result all the traffic goes directly to the origin (as a side-effect, your origin IP address is revealed to the attacker).
You receive the email "Sorry, CF offers limited DDoS Protection, call our Enterprise team for help".
From your blog post I understand you don't do it anymore, which is good. Really, it was quite bad to see the DDoS protection failing you when you need it the most :|
TL;DR: This doesn't happen anymore.
(Disclosure: I work for Cloudflare but I don't know anything more about this than is written in the blog post.)
To be fair, at the time I believe "DDOS protection" was a feature only explicitly listed on their $200/month plan, and I was on the $20/month plan. I think it's part of all plans for the last few years now.
At my job now, we use cloudflare workers, but I'm almost hesitant to rely on them too much because I know they'd all break immediately if CF ever decided to surprise-switch our account off of the proxy-though-CF mode like I had happen before. I don't know if that move is still part of CF's playbook or not given the changes in how they handle DDOS attacks; maybe I'm being a bit irrational since the DDOS attacks were a painful experience to deal with overall. I hope this time CF will just ask us for more money if there's a problem before pulling out the rug. Other than that bad experience around that DDOS attack, CF has been one of my favorite services.
Workers actually launched four days later. Funny, I didn't realize at the time that unmetered mitigation was really a prerequisite for Workers -- obviously you couldn't build very much in Workers if a random DDoS attack could cause it to just shut off. Huh...
(I'm the lead engineer on Workers.)
Could be called "A business plan upgrade moment"