When Interserver, a long-running hosting provider, took a significant DDoS attack, Path Network publicly walked through how its scrubbing infrastructure absorbed it [Path Network Blog]. That kind of incident write-up is the wedge Path has been sharpening since 2018. The New York company sells DDoS mitigation built on XDP, the in-kernel Linux packet processing path, and routes traffic through a 12 Tbps network spread across 22 major internet hubs [Path Network].
That capacity figure is the headline number Path leans on when it courts hosting companies, game server operators, and infrastructure resellers. The company's product page describes a patented stateful cloud firewall with hole-punching capabilities and application-layer filtering tied to RFC protocol specifications [LinkedIn]. Rather than just rate-limiting or blackholing traffic, Path inspects packets at line rate and drops the bad ones close to where they enter the network. XDP is the right primitive for that job, as it runs filtering logic inside the kernel before the networking stack allocates an skb.
The bet
Path's go-to-market is the hosting channel. The company published a recommended protection setup that explicitly calls out resellers and hosting companies, pointing them at an API that plugs into WHMCS so end users can manage their own whitelist rules [Path Network Support]. There is also a dedicated Path.net module on the WHMCS Marketplace [WHMCS Marketplace]. Selling once to a hosting provider that resells protection to thousands of downstream tenants is efficient. Partnerships with Hetzner and FastNetMon extend the same pattern, putting Path's scrubbing capacity in front of customers who already have a billing relationship with someone else [Path Network Blog].
The customer roster includes names that matter for credibility. ZoomInfo's profile cites the US Army and Pentagon among organizations that have used Path for real-time threat detection [ZoomInfo]. Federal logos are hard to confirm in detail, but their presence in third-party databases is consistent with the company's positioning around mission-critical uptime.
Why the shape of the market favors them
DDoS volumes have been climbing for years, and the economics of attack generation keep getting worse for defenders. The incumbents in this category, Cloudflare, Akamai, and Imperva, are formidable but have historically optimized for HTTP-fronted web properties rather than the UDP-heavy, latency-sensitive workloads that game hosting demands. That gap is where Path is operating.
| Metric | Value |
|---|---|
| Global network capacity | 12 Tbps |
| Internet hubs | 22 locations |
| Disclosed seed funding | $1M |
The funding picture is modest by category standards. Path disclosed roughly $1M in seed capital in 2019 [FinSMEs, 2019] [PRNewswire]. For a company building physical infrastructure across 22 points of presence, that is a lean number, suggesting either heavy reliance on transit and colocation partnerships or substantial revenue funding the buildout.
Team and traction
Public founder details are not in the captured record, but the engineering signal is visible in the work: a NANOG87 presence, blog posts that read like they were written by network operators, and a support knowledge base that assumes the reader knows what BGP, WHMCS, and 95th percentile billing are [Path Network Blog]. Customer reviews on Trustpilot include multi-year users who describe Path's protection as the best they have used, with specific praise for gaming workloads [Trustpilot].
The honest counterfactual
The bear case is in the same review channel. Some Trustpilot users have flagged outdated filtering methods and recent uptime disruptions, particularly for game server use cases [Trustpilot]. An October 2025 LowEndTalk thread aired similar concerns from the hosting community [LowEndTalk, October 2025]. Path's own response, posted on Trustpilot, acknowledges the criticism directly: the team says it is actively modernizing its filtering approach, expanding application support, and addressing the recent disruptions [Trustpilot].
What to watch
The next twelve months should clarify two things. First, whether Path raises a priced growth round, which would force more disclosure about revenue and ownership. Second, whether the company ships a visible refresh of its filtering stack in response to the Trustpilot and LowEndTalk feedback. Landing a named cloud or telco partnership beyond Hetzner and FastNetMon would be the third signal worth watching.
Technical breakdown
XDP hooks packet processing into the Linux kernel at the driver level. For DDoS mitigation, that means filter decisions cost on the order of tens of nanoseconds per packet rather than microseconds, which is what makes 12 Tbps of stateful filtering economically tractable on commodity x86. The tradeoff is that XDP programs run under eBPF constraints. Complex application-layer logic has to be split between the XDP fast path and userspace. Path's description of a stateful cloud firewall with hole-punching and RFC-based application filtering is consistent with that hybrid design [LinkedIn].
What could go wrong at scale
Three risks compound. The hosting-channel motion concentrates revenue in a small number of resellers, so the loss of a Hetzner-class partner would leave a visible hole. XDP-based mitigation is powerful but operationally demanding, and the recent uptime complaints suggest that operational maturity is still a work in progress. And the well-funded incumbents are not standing still: Cloudflare's Magic Transit and Akamai's Prolexic both target the same UDP-heavy, latency-sensitive workloads Path competes for, with deeper pockets and broader peering.