Nexusguard

What Nexusguard actually is

Nexusguard is not a hosting provider and not a general-purpose cloud — it is a managed DDoS mitigation specialist, and the distinction matters when you read listings like this one. Founded in 2008 and headquartered in Singapore, the company sells always-on protection for networks, web applications, DNS, and origin servers, with a heavy tilt toward communications service providers: telcos, ISPs, hosting companies, and MSSPs that want to resell DDoS protection under their own brand. Nexusguard's own numbers put the installed base at more than 100 CSPs and over 50,000 protected ASNs, and its "Bastions" technology underpins both on-premise appliances and a cloud scrubbing network.

The architecture is what the vendor calls "True Hybrid": traffic can be scrubbed on a local Bastions appliance in a provider's own datacenter and automatically spill over to the global cloud scrubbing network when an attack outgrows local capacity. That design is aimed squarely at carriers who need in-country deployment for regulatory or latency reasons but still want volumetric headroom. For end customers who simply buy the managed service, the same network does the filtering: traffic is rerouted (BGP, GRE tunnels, DNS redirection, or a physical cross-connect where you are co-located with a Nexusguard point of presence) and scrubbed before it reaches your origin.

Coverage spans network-layer and application-layer attacks. The Application Protection product layers a web application firewall over the DDoS service — OWASP Top 10 threats, API attacks, and bot management — but note that this is a secondary layer inside a DDoS product, not a standalone WAF competing with Cloudflare or Akamai on its own terms. DNS Protection is sold separately as a hosted or fully managed authoritative DNS service with its own availability guarantee. If your mental model is "CDN with a security toggle," this is not that; if your model is "carrier-grade scrubbing we can hand to our SOC," it is close.

Pricing: what you really pay

Here is the honest answer: Nexusguard does not publish a price list. There is no self-service signup, no free tier, and no public per-gigabit or per-month rate — even its AWS Marketplace listing routes to contact-sales. Everything is quoted, typically as a flat-rate contract rather than burst-sensitive metering. That flat-rate approach is deliberate and is one of the few genuinely customer-friendly things in enterprise DDoS: you do not get a surprise bill precisely when you are under attack, which is the failure mode of usage-priced mitigation. The analyst house QKS Group highlighted exactly this in its 2026 SPARK Matrix assessment, calling out a commercial model "that doesn't penalize customers financially during the very attacks they're trying to survive."

For our audience on our benchmarks — people comparing entry-level cloud servers on price-performance — that opacity means Nexusguard cannot be line-item compared against a €5 VPS or a self-hosted proxy. Budget realistically for enterprise security spend: sales engagement, a contract term, and usually an integration project (BGP announcements or GRE tunnels to your upstreams). The CSP program is a different commercial shape again — partners white-label the service and resell it, with training and go-to-market support bundled in. If you are an end customer rather than a reseller, treat the listed entry figure in any database, ours included, as unverified until you have a quote in hand. We have flagged the placeholder pricing on our own listing for correction.

What you do get for the money is worth stating plainly: flat-fee DNS Protection with a guaranteed 100% availability SLA, always-on mitigation rather than an "activate during attack" model, attack logs and traffic forensics for compliance work, and access to a network of scrubbing centers that the vendor describes as 40+ points of presence on its cloud deployment page and "over 50 scrubbing centers" in its 2026 press material. That discrepancy is theirs, not ours; the safe reading is "several dozen globally distributed scrubbing sites."

Performance & infrastructure

The scrubbing network is the product. Nexusguard's Smart Route policy engine distributes users to the geographically appropriate scrubbing centers — European users to a European region, US users to a US region — with health checks that automatically disable routing rules to any scrubbing center that is down for maintenance or otherwise unavailable, and re-enable them when it returns. For multi-continent customers that is the difference between mitigation that works and mitigation that detours all of Asia through Los Angeles during an attack. On-net mitigation is faster than upstream diversion, and the vendor supports both: cloud-only deployment via BGP or GRE, and direct connect with 1 and 10 Gbps fiber cross-connects for CSPs co-located at Nexusguard's facilities.

Capacity figures from third-party reviews are dated and modest by 2026 standards — one review cites 1.44 Tbps of scrubbing capacity across eight centers — while the vendor's current material describes a much larger footprint. We would not underwrite an attack-mitigation SLA on old review numbers; ask the vendor for current per-PoP and aggregate capacity, and get it in the contract. On reliability track record the story is stronger: eighteen years in mitigation, deployed inside more than 100 carriers, protecting over 50,000 ASNs, with analyst recognition in QKS Group's DDoS mitigation assessments in both 2025 and 2026. This is not a startup learning to scrub on your traffic.

For the DNS product specifically, the SLA is concrete: a guaranteed 100% availability commitment, backed by a globally distributed authoritative DNS platform that absorbs DNS-based floods while resolving legitimate queries. Website and origin protection SLAs are contract-negotiated rather than published, which is normal for this tier but means SLA honesty here depends on your legal review, not on a marketing page.

Where it falls short

Start with procurement friction: no public pricing, no free trial we could find, no self-service onboarding. For a small SaaS team that wants DDoS coverage by lunchtime, this is the wrong vendor — a CDN-based service with published plans is faster to buy and cheaper at low traffic. Second, deployment complexity is real: DNS or traffic rerouting, BGP announcements or GRE tunnels to your upstreams, firewall and routing changes, and usually a network engineer in the room. The DB entry's claim of "instant failover and geo-redundancy" is fair for the network itself, but onboarding is a project.

Third, the CSP-first positioning cuts both ways. Nexusguard builds for carriers first; enterprises are served, often through those carriers or MSSPs, but the product roadmap, docs, and partner program are provider-shaped. If you want a developer-first portal, Terraform providers, and a community forum, the Kubernetes-adjacent security vendors are more your speed. Fourth, the WAF is a companion layer, not a best-of-breed application firewall; teams with serious bot management or API security requirements may still need a dedicated product. Finally, the pricing model is traffic-scaled in practice: flat-rate helps predictability, but if your traffic profile is spiky and large, the tier you are quoted is sized for your peaks, and you pay for that headroom all year.

Who should pick this

Our pick for communications service providers and hosting companies that want to sell DDoS protection as a managed service — the white-label DPaaS model, the Bastions appliances for in-country deployment, and the partner enablement program are built for exactly that buyer. We would also shortlist it for APAC-heavy enterprises and government bodies that need local scrubbing and in-region support; Nexusguard's center of gravity is Asia-Pacific, with additional reach into the Americas, Europe, and the Middle East, and it is strong where US-centric vendors are thin.

For an enterprise that wants always-on mitigation with contractual SLAs, flat-rate pricing, and forensic reporting for compliance, it is a credible shortlist entry alongside the large CDN-security vendors — priced and pitched at the same tier. For everyone else — startups, small teams, single-server operators, anyone who wants to compare euros-per-vCPU — look at the security features bundled with your cloud provider instead. DDoS protection is infrastructure insurance; buy the policy that matches the size of what you are insuring.

Key takeaways

• Managed DDoS mitigation specialist (est. 2008, HQ Singapore) built for CSPs, ISPs, and enterprises; not a hosting or general cloud platform
• True Hybrid model: on-site Bastions appliances plus a global cloud scrubbing network with geolocation-aware routing and automatic failover
• Flat-rate, quote-only pricing with no free tier — the model avoids bill shock during attacks, but nothing is publicly list-priced
• DNS Protection carries a guaranteed 100% availability SLA; website/origin SLAs are negotiated per contract
• Strongest fit for APAC carriers and enterprises reselling or buying managed mitigation; too much procurement and deployment overhead for small teams
• WAF and bot management are layered add-ons to the DDoS service, not a standalone application-security platform

Sources

• https://nexusguard.com/about
• https://nexusguard.com/press/nexusguard-positioned-as-a-leader-in-the-spark-matrix-distributed-denial-of-service-ddos-mitigation-2026-by-qks-group
• https://nexusguard.com/dns-protection
• https://nexusguard.com/cloud-deployment
• https://nexusguard.com/blog/smart-route-optimizing-geolocation-routing
• https://wafplanet.com/waf/nexusguard
• https://business.com/reviews/nexusguard
• https://ingaming.io/companies/nexusguard