Andrejs Tihanovs – Is the Biggest Attack Always the Most Dangerous One?
Andrejs Tihanovs is Technical Product Manager at RETN in Riga. He joined RETN four years ago as a network engineer and moved into the product manager role a year ago. Before that, he spent 15 years working as a network administrator for various Latvian ISPs and hosting providers.
At BalticNOG 2026, Andrejs will bring 12 months of RETN network data to the stage with his talk, “Is the Biggest Attack Always the Most Dangerous One?”
Why Peak Size Isn’t the Whole Story
For network operators, ISPs, and telcos across the Baltics, DDoS risk is changing, and the biggest attack isn’t necessarily the most dangerous one. Andrejs will challenge the industry’s continued focus on peak attack size as the primary measure of threat. A 24.9 Tbps attack observed on RETN’s network in November 2025 was almost nine times larger than any other monthly peak in the dataset, yet its size alone said little about the actual impact on a network or its customers.
When Smaller Attacks Do More Damage
Andrejs will show how smaller, distributed, and deliberately low-volume attacks can end up more disruptive than record-breaking floods. Carpet-bombing, precision attacks, and evolving attack techniques can target multiple prefixes, put real pressure on network infrastructure, or slip past traditional detection thresholds entirely, all without producing the traffic volumes that make headlines.
What Baltic Operators Should Actually Be Watching
Andrejs will examine how the threat is evolving specifically around the region, including risks from compromised network equipment and distributed attack sources. His core argument: operators need to look past bandwidth alone and start measuring detection speed, affected targets, root-cause clarity, and how long it actually takes to understand and contain an attack.
Why You Shouldn’t Miss This Talk
If your DDoS strategy is still built around watching for the next record-breaking flood, this talk makes the case for rethinking what you’re actually measuring. Andrejs brings a full year of real network data from RETN, not just theory about what attacks could look like.
Whether you operate a network in the Baltics or just want a sharper framework for evaluating DDoS risk, this talk gives you the data and the questions to ask next.
đź“… When: 23-24 September 2026
đź“Ť Where: BalticNOG 2026, Riga, Latvia
đź”— Don’t miss BalticNOG! Register today: https://balticnog.org/tickets/
