---
title: "How AI-Powered Attacks Led Salesforce to Reinvent Hyperscale DDoS Defense"
description: "Salesforce built DREAM (DDoS Response and Mitigation) to defend its distributed cloud against hyperscale, machine-speed DDoS attacks, with a stated goal of responding in seconds while protecting more than 4.5 million domains and 3 million customer orgs at 99.99% availability. The platform targets rapidly evolving application-layer attacks in a shared, multi-tenant environment by combining AI-driven inference with distributed orchestration for telemetry, policy deployment, notifications, retries, and fault-tolerant execution across regions. The team selected Temporal rather than rebuilding distributed-systems primitives, and used AI coding assistants to migrate about 100,000 lines at roughly ten times prior velocity; more than 90% of the rewrite was AI-assisted, with human reviews and test coverage above 95%. Production lessons moved bulk data outside orchestration and bounded workflow history, while DREAM reduced time to first mitigation fivefold."
---

# How AI-Powered Attacks Led Salesforce to Reinvent Hyperscale DDoS Defense

[Salesforce](https://yomu.fyi/company/salesforce) · Scott Nyberg · Aug 28, 2026

**Type:** Explainer

## Summary

Salesforce built DREAM (DDoS Response and Mitigation) to defend its distributed cloud against hyperscale, machine-speed DDoS attacks, with a stated goal of responding in seconds while protecting more than 4.5 million domains and 3 million customer orgs at 99.99% availability. The platform targets rapidly evolving application-layer attacks in a shared, multi-tenant environment by combining AI-driven inference with distributed orchestration for telemetry, policy deployment, notifications, retries, and fault-tolerant execution across regions. The team selected Temporal rather than rebuilding distributed-systems primitives, and used AI coding assistants to migrate about 100,000 lines at roughly ten times prior velocity; more than 90% of the rewrite was AI-assisted, with human reviews and test coverage above 95%. Production lessons moved bulk data outside orchestration and bounded workflow history, while DREAM reduced time to first mitigation fivefold.

## Context

Salesforce needed to replace a first-generation DDoS platform nearing end of life while defending a shared, multi-tenant cloud against increasingly sophisticated application-layer attacks that evolve and execute at machine speed. An attack targeting one customer can consume shared infrastructure and create risk for other tenants, requiring mitigation decisions within seconds. The rebuild had to be completed in just over three months before existing licenses expired.

## Approach / What changed

DREAM combines AI-driven attack inference with a distributed orchestrator, using workflows and activities to coordinate telemetry, mitigation policies, notifications, retries, and regional fault tolerance. The team chose Temporal instead of rebuilding state management, retries, locks, and failover, then used AI coding assistants to migrate roughly 100,000 lines of legacy code. Human reviews, coding standards, model guidance, and AI-generated tests supported the rewrite. Large datasets are stored externally and workflows pass lightweight references, while long-running history is periodically bounded.

## Takeaways

- DREAM reduced time to first mitigation by 5x across a shared cloud processing roughly 20 trillion transactions annually.
- The team delivered a working MVP in three weeks and a production-ready platform ahead of schedule after migrating about 100,000 lines of legacy code at approximately ten times the previous development velocity.
- Production failures showed that orchestration should coordinate work rather than store its data: bulk payloads moved to external storage, and workflow history was periodically reset to keep recovery costs bounded.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Machine Learning](https://yomu.fyi/topic/machine-learning), [Reliability](https://yomu.fyi/topic/reliability), [Scalability](https://yomu.fyi/topic/scalability)

- Source: [Salesforce](https://engineering.salesforce.com/how-ai-powered-attacks-led-salesforce-to-reinvent-hyperscale-ddos-defense)
- Source URL: https://engineering.salesforce.com/how-ai-powered-attacks-led-salesforce-to-reinvent-hyperscale-ddos-defense
- Ingested by Yomu: 2026-08-28T20:00:51.263Z

[Read original post](https://engineering.salesforce.com/how-ai-powered-attacks-led-salesforce-to-reinvent-hyperscale-ddos-defense)