Clean Pipe as a Service

Attacks stop at the edge. Good traffic never notices.

We clean your upstream traffic before it reaches your network. You pay monthly. We own the kit, refresh it and run it. For data centres, ISPs, telcos, critical infrastructure and enterprises.

Book a free DDoS exposure review How it works

A 99.999% SLA allows 26 seconds of downtime a month.

One bar is one second

Four six-second attacks that knock customers offline use 24 of them. Corero’s 2026 data shows attack waves as short as six seconds, and the average protected network sees 12.3 attacks a day.

Inline, behind your edge router

Attack traffic is dropped at the edge. Clean traffic carries on to your tenants and subscribers without being rerouted.

Mixed traffic in

Transit

Upstream carriers

Peering

Direct exchange

IXPs

Internet exchanges

Your edge router

Xcidic Clean Pipe

Corero SmartWall ONE

DDoS dropped in seconds, Layers 3 to 7

AXGATE NGFW

Firewall policy for each tenant

Monitored 24/7 by XcidicAttacks dropped

Clean traffic out

Colocation tenants

Enterprise DIA

Subscribers and DNS

DDoS engine, United Kingdom

SmartWall ONE detects and drops attacks automatically, including encrypted TLS floods. It runs inline, or on your existing Juniper, Cisco and Nokia routers. A Leader in the QKS SPARK Matrix 2026.

Firewall and policy, South Korea

Keeps management, tenant and subscriber networks apart. Listed on KOSDAQ, with a VPN certified by Korea’s National Intelligence Service and trusted by the Korean military.

Everything behind your edge router

Clean Pipe covers the shared uplinks and every customer service that sits behind them.

Shared uplinks

An attack on one customer can’t flood them all.

DNS infrastructure

Authoritative servers and resolvers stay up.

Web, apps and APIs

Sites, logins and APIs keep answering.

Tenants and DIA

Each customer gets its own firewall policy.

Remote access VPN

VPN gateways stay reachable for remote staff.

Management networks

Kept apart from customer traffic.

What Clean Pipe stops, layer by layer

Every attack below is dropped at your edge, from network floods to threats hidden in encrypted sessions.

1234567

Application

Layer 7

  • HTTP/HTTPS floods
  • DNS water torture
  • Low-and-slow attacks
  • Bots hidden in TLS traffic
  • Risky apps and devices
  • Intrusion attempts
1234567

Session and TLS

Layers 5 to 6

  • TLS renegotiation abuse
  • TLS handshake abuse
  • Protocol violations in TLS
  • Threats in encrypted sessions
1234567

Transport

Layer 4

  • TCP floods
  • SYN floods
  • UDP floods
  • Malformed and truncated packets
  • Invalid TCP segment IDs
  • Bad checksums and flags
  • Invalid port numbers
1234567

Reflection

Layers 3 to 4

  • DNS amplification
  • NTP monlist
  • CLDAP
  • SSDP / UPnP
  • SNMP
  • CHARGEN
  • TeamSpeak, RIPv1 and NetBIOS payloads
1234567

Network

Layer 3

  • ICMP floods
  • IP fragmentation floods
  • Fragmentation evasion
  • Carpet bombing
  • IPv6 abuse
  • Geo-spoofing and ISP masking
  • Cross-tenant access
  • VPN interception
1234567

Multi-vector

Layers 3 to 7

  • Short pulse attacks
  • IoT botnets
  • Botnet and source floods
  • Zero-day attacks

Typical time to mitigation is under 10 seconds. Coverage depends on the models and licences deployed.

The same protection, as a monthly service

You don’t buy, run or replace the hardware. Protection gets budgeted like connectivity, not like a capital project.

Hardware refresh

When the Corero and AXGATE appliances reach end of life, we replace them at no extra cost.

Help when an attack lands

Our engineers work with your team through up to four incidents a year, from first alert to recovery.

Training for your NOC

Your network and security staff learn the dashboards, alerts and reports.

A yearly audit

We check mitigation thresholds, firewall policies and capacity against your growth.

One vendor answers for it

One contract, one number to call, no blame passed between suppliers.

Your subscription

Every month

Hardware refresh
Free
Cyber incident assistance
Up to 4 a year
Team training
Free
Clean Pipe system audit
Free, yearly
Vendors responsible
One
You payOne monthly instalment

Booked as OPEX, so there’s no capital approval to chase

Buy it, or subscribe

What you need Buying appliances Clean Pipe as a Service
Upfront cost A large capital purchase None. A fixed monthly instalment
End-of-life hardware Another purchase every refresh cycle Replaced free
Help during an attack A separate support contract Up to four incidents a year included
Staff training Bought separately Included
Health check Arranged and paid for separately Yearly audit included
Who answers for it Hardware, transit and support vendors Xcidic, end to end

See it catch real attacks before you commit

From baseline to live protection in four steps. Your instalment only starts at step three.

  1. Step 1

    Baseline

    We map your uplinks, peering, DNS and traffic, then show where an attack would hurt first.

  2. Step 2

    Prove

    SmartWall runs in monitor-only mode on your real traffic. You see what it catches first.

  3. Step 3

    Subscribe

    We deploy the kit at your edge, sized to your capacity. Your monthly instalment starts.

  4. Step 4

    Operate

    24/7 monitoring, tuning, incident assistance, training and the yearly audit.

Proven at data centre scale

“Our time to mitigation for DDoS attacks went from six minutes with previous solutions to 18 seconds with Corero.”
Paul Mazzucco, CISO, TierPoint40+ data centres in 20 US markets

Carriers, cyber authorities and governments across Asia already work with Xcidic

  • Telkomsat, ID
  • Linknet, ID
  • HKCERT, HK
  • Ministry of Foreign Affairs, ID
  • Jabar Digital, ID
  • PCCW Global, HK

Your network.
Kept clean.

Book a free DDoS exposure review. We baseline your traffic and show you where an attack would hurt first. No obligation.

Book a free exposure review

Prefer to write?
sales@xcidic.com