January 2026 Summaries

Fastly Compute offers an effective platform for handling AI workloads by utilizing low-latency edge execution and WebAssembly sandboxing for enterprise-grade security. The platform supports the implementation of AI agent loops using LLM APIs, which enhance the accuracy and efficiency of AI responses through iterative feedback processes. These agent loops allow AI systems to autonomously perform tasks by continuously reasoning, planning, acting, and observing results until the objective is achieved. Fastly Compute's environment ensures optimal speed and security by isolating workloads and providing features like linear memory bounds checking and restricted network I/O. The platform also supports advanced security measures, such as limiting backend requests and utilizing dynamic backends to control agent behavior, thereby safeguarding AI workflows from potential vulnerabilities. Through these capabilities, Fastly Compute enables the development of AI agents that can substantially improve productivity and operational efficiency.

Edge Side Includes (ESI) was introduced in the early 2000s by Akamai to help developers manage dynamic content at the network edge, enhancing performance and reducing server load, but it never achieved standardization and became proprietary, leading to vendor lock-in for many organizations. Fastly has now developed a new ESI implementation powered by Fastly Compute, which not only replicates Akamai's native ESI features but also provides additional capabilities such as control flow, error handling, variables, and complex data types. This new implementation offers a high-performance engine that allows ESI tags to run on Fastly’s global network, facilitating the transition from static templates to fully programmable edge logic. Although ESI was never designed for the complexity of modern web applications, Fastly's solution allows organizations to maintain existing ESI functionality while incrementally refactoring workloads into more advanced languages like Rust or JavaScript, opening the door to modern features like passwordless authorization and edge-rate limiting.

In December 2025, Fastly reported its largest Distributed Denial of Service (DDoS) attack of the year, dubbed the "Grinch Attack," which targeted a high-tech enterprise during the Christmas holiday, a time when cybersecurity defenses are often lower. This sophisticated attack utilized multiple DDoS vectors, including a combination of high-level requests per second (RPS) and low-level packets per second (PPS) attacks, reaching over 100 million RPS and lasting approximately 48 hours. Fastly's DDoS Protection, leveraging its global edge network, generated over a thousand automated rules to successfully isolate and mitigate the attack traffic without impacting legitimate users. The attack, primarily sourced from countries like the United States, Brazil, and Mexico, highlights the need for automated and always-on security solutions to defend against increasingly complex DDoS threats, as attackers target vulnerable times to disrupt operations.

Server-Timing, a specification established in 2015, enables servers to communicate performance metrics related to the request-response cycle to user agents via an HTTP response header. This feature, now supported by most browsers, helps visualize these metrics through developer tools, thus offering insights into various stages of web page processing, such as database lookups, template processing, and caching. By implementing Server-Timing headers in different systems such as origin servers, compute applications, and delivery applications, developers can trace end-to-end latency and identify performance bottlenecks. Although the specification suggests focusing on duration metrics, it is possible to include additional information, such as caching behaviors and network protocol metrics, resembling distributed tracing practices. Despite its utility, care must be taken to avoid exposing sensitive information through these headers. Server-Timing’s capability to provide a detailed view of latency across different systems makes it a valuable tool for optimizing web performance and diagnosing complex request pathways.

Broadcasting live sports presents unique challenges due to the unpredictable spikes in viewer demand, requiring broadcasters to design their infrastructure for volatility rather than averages. Fastly, having supported numerous high-stakes live events, emphasizes preparation over prediction, building systems that handle sudden traffic surges and adapt seamlessly to changing conditions. This approach mirrors the mindset of elite performers like Jerry Rice, who achieved success through disciplined preparation, allowing him to execute flawlessly under pressure. Fastly is hosting a live event on February 3, 2026, featuring Jerry Rice and Fastly's Field CTO Omeed Nosrati, to explore the parallels between high-performance sports and live streaming infrastructure, highlighting how thorough preparation and instinctive execution are critical for success in high-pressure environments.

Fastly has introduced embedded challenges as an enhancement to its Bot Management solution, which aims to combat unwanted bot traffic while maintaining a seamless user experience. Building on the existing Dynamic Challenges feature that utilizes Apple's Private Access Tokens and adaptive verification methods, this new capability allows these challenges to be seamlessly integrated within any webpage, such as login pages, to align with the brand's look and feel. By embedding a script tag, CSS, and a simple <div> tag, customers can easily incorporate these security measures without disrupting the user journey. This innovation seeks to balance robust security against bot attacks with minimal friction for legitimate users, ensuring customer retention and satisfaction.

Fastly has introduced new security packages aimed at simplifying the process of purchasing, using, and expanding security measures to protect applications as they evolve. These packages offer transparent and predictable pricing to minimize complexity and enhance protection, while advocating for a layered defense-in-depth strategy that integrates seamlessly with existing workflows. This approach reduces the need to juggle multiple vendors, thus avoiding "integration debt," and creates a cohesive "immune system" where different security layers communicate effectively. Key components of this strategy include a Next-Gen Web Application Firewall, API Security, DDoS Protection, Bot Management, and Client-Side Protection, all of which contribute to safeguarding applications from diverse threats. Fastly's modular offerings allow businesses to start with essential security features and expand as their needs grow, ensuring cost-efficiency and scalability without the concern of unexpected expenses. By adopting this modular, layered security approach, organizations can effectively counteract sophisticated threats while maintaining budgetary and operational efficiency.

API security is crucial for safeguarding sensitive data and maintaining the integrity of web applications, given that APIs are increasingly targeted by attackers due to their role in facilitating communication between different systems. Effective API security involves implementing protective measures throughout the API lifecycle, including designing secure APIs, conducting thorough testing for vulnerabilities like unauthorized access and injection attacks, and applying strong authentication and authorization protocols. Continuous security testing is essential, especially during development, staging, and after any changes to the API. Tools such as API scanners, penetration testing platforms, and runtime protection solutions are used to identify risks, but no single tool can cover all vulnerabilities, necessitating a layered testing approach. Content Delivery Networks (CDNs) enhance API security by enforcing edge protections, such as rate limiting and anomaly detection, to mitigate threats before they reach backend systems. Fastly offers a comprehensive API security solution that combines secure design, continuous automated testing, and edge-based protection to reduce the risk of API exploitation while ensuring performance and scalability.

A content delivery network (CDN) is a system of distributed servers that enhance web content delivery by caching essential files such as HTML, JavaScript, and images on edge servers closer to users' geographical locations, thus reducing latency and improving load times. CDNs, while effective in delivering assets quickly, work best in tandem with browser caches to optimize website performance. Cache busting is a technique used to ensure browsers retrieve updated files instead of outdated cached versions, often implemented by appending versioning parameters to URLs. Although CDNs provide a geographical advantage, their efficiency is complemented by browser caches, especially when employing a strategy of short time-to-live (TTL) for browser caches and longer TTLs with purging capabilities on CDNs. Additionally, techniques like revalidation, involving headers such as Last-Modified and ETag, allow browsers to efficiently manage cached objects, reducing bandwidth usage and enhancing user experience. Combining these caching strategies can significantly reduce load on origin servers, improve response times, and result in better performance for end-users, even in areas with limited connectivity.

Google's emphasis on user experience in website rankings hinges on Core Web Vitals (CWV), which evaluates loading performance, interactivity, and visual stability. These metrics—Largest Contentful Paint (LCP), Interaction to Next Paint (INP), and Cumulative Layout Shift (CLS)—are crucial for determining a site's usability and impact search visibility and rankings. Improving CWVs involves optimizing LCP by using a modern Content Delivery Network (CDN), which enhances time-to-first-byte (TTFB), caches API responses, and compresses images at the edge. CDNs like Fastly can improve performance by delivering stale content when origin servers lag, handling high-volume requests, and offering security features such as DDoS protection. They also accelerate load times for large files, enable caching of dynamic content, and optimize images by serving them from the nearest location and adjusting them for end-user devices, ultimately enhancing the overall user experience and maintaining competitive SEO standings.

Credential stuffing attacks, a subset of brute force attacks, exploit stolen usernames and passwords to gain unauthorized access to multiple websites, leveraging the common practice of password reuse. These attacks are more targeted compared to the broader approach of brute force attacks, which rely on systematically guessing passwords to exploit systemic vulnerabilities for financial, informational, and strategic gains. Credential stuffing involves using tools like botnets and IP rotation to avoid detection, allowing attackers to initiate account takeovers. To mitigate these threats, a multi-pronged security strategy is recommended, including advanced multifactor authentication, behavioral biometric integration, zero-trust architecture, adaptive rate limiting, and advanced bot detection technologies. Preventative measures also encompass passwordless authentication strategies, automated credential rotation, threat intelligence integration, honeypot technology, and continuous penetration testing. Additionally, services like Fastly offer solutions such as Web Application Firewalls, DDoS protection, and real-time threat classification to safeguard against these cyberattacks.