Security appliances (throughput tax)
Every security box you rack — firewall, intrusion detection, web application firewall — sits in the path of real traffic and reads it on the way through. Reading takes time, so the box can only move a fraction of its advertised speed once it is actually inspecting. A line-rate firewall doing deep inspection commonly runs at around 40% of the number on the label. The protection is real; so is the toll it takes on your pipe.
DDoS floods, intrusions and dirty traffic do not wait for you to be ready. The only defence that works is the one you already installed. A scrubber soaks up attack traffic up to its rated size; anything over that pours onto your uplinks and crowds out paying customers. Pre-provision the capacity before you need it — racking an appliance in the middle of an attack does not help, the damage is already landing.
Banks, healthcare and payment processors will not sign with a provider who cannot show a firewall, a web application firewall and audit logs. Climbing the security ladder is not optional flavour — it is the gate that unlocks the customers who pay the most. Security spend reads as a cost until the day it is the only reason a Platinum tenant stayed.
Detailed explanation
Firewall, IDS/IPS, WAF, DDoS Scrubber, HSM and SIEM install on the rack-U surface exactly like a switch — same mounting, same cabling, same reachability rules. Inspection-enabled appliances carry a lower effective throughput than their nameplate: deep packet inspection, TLS termination and signature matching are CPU-bound, so an appliance doing real inspection delivers a fraction of line rate. Size for the inspected throughput, not the label.
Scrubber appliances absorb attack traffic up to their rated Gbps. Overflow = max(attack_gbps - total_scrubber_gbps, 0) is added to egress and saturates your uplinks, which starves genuine customer requests of bandwidth — arrivals drop, p99 craters, SLAs breach. Because the scrubber must already be racked and reachable when the attack starts, provisioning is a planning decision made on a calm day, not a reaction.