Skip to content
HOMETECH DIRECTORYNEWS & DEVELOPMENTSRELOCATEEMPLOYERSNEIGHBORHOODSABOUTSchedule a Call

Arbor Networks: The U-M DDoS Pioneer That Seeded Ann Arbor Cybersecurity

Arbor Networks was the Ann Arbor DDoS company spun out of U-M in 2000 by Farnam Jahanian. NETSCOUT acquired it in 2015. Its alumni network seeded Duo an...

A2Hub Editorial· Rusty Roof Media· Updated May 4, 2026

Arbor Networks

By A2Hub Editorial. Published 2026-04-22. Last updated: 2026-04-22.

At a glance

  • Founded: 2000
  • Founders: Farnam Jahanian, Robert Malan, and colleagues from the University of Michigan
  • Original HQ: Ann Arbor, Michigan (with Burlington, MA operations expanded over time)
  • Headcount: Current Ann Arbor-specific headcount inside NETSCOUT not publicly disclosed; historical peak as an independent company ran several hundred across Ann Arbor and Burlington
  • Acquisition history: Acquired by Danaher in 2010; acquired by NETSCOUT in July 2015 as part of NETSCOUT's purchase of Danaher's Communications business at approximately $2.3B (announced October 2014 at $2.6B headline)
  • Current form: "Arbor DDoS" product line under NETSCOUT, plus continuing Ann Arbor engineering presence
  • Status: Operating as a NETSCOUT business line
  • Website: netscout.com/arbor

The U-M DDoS company that defined the carrier-grade security playbook

Arbor Networks is the Ann Arbor cybersecurity company that should be on every founder's mental shortlist when they ask why Ann Arbor security exists. Founded in 2000 as a University of Michigan and DARPA-funded spinout, Arbor was the first company to productize carrier-grade DDoS detection and mitigation at internet scale. It built the products that ISPs and global carriers still rely on. It exited through two parents (Danaher in 2010, then NETSCOUT in 2015 at roughly $2.3B in transaction value). And its alumni network is the most important single feeder into the modern Ann Arbor cybersecurity cluster, including the founder of Duo Security.

The Ann Arbor engineering operation continues inside NETSCOUT. The Arbor DDoS product line continues to ship and serve carrier customers. And the lineage from Farnam Jahanian's late-1990s U-M lab to today's downtown Ann Arbor security cluster is direct, traceable, and structurally important.

What Arbor Networks makes

Arbor Networks productized carrier-grade DDoS detection and mitigation at scale before the rest of the industry caught up. The core products, now sold under the Arbor DDoS line within NETSCOUT, include:

  • Arbor Sightline. Network-wide traffic and anomaly visibility platform. Ingests NetFlow, sFlow, and BGP data from ISP and enterprise network infrastructure, correlates it in real time, and identifies DDoS attacks and traffic anomalies. The de facto standard at most large ISPs for monitoring upstream traffic.
  • Arbor Threat Mitigation System (TMS). In-network mitigation appliances that scrub malicious DDoS traffic before it reaches customer infrastructure. Used by carriers and hosting providers to protect large customers from volumetric and application-layer attacks.
  • Arbor APS (Availability Protection System) / Arbor Edge Defense. On-premise and edge DDoS protection for enterprise networks, integrated with broader NETSCOUT network observability products.

The technical thesis that made Arbor work, from the earliest days, was that you cannot mitigate network-level denial-of-service attacks from inside the target's infrastructure. You have to see the traffic upstream, at the carrier level, and mitigate at the scale and speed of the carrier's backbone. That thesis required a carrier-centric commercial motion and an engineering culture that could scale detection and mitigation algorithms to millions of packets per second. Arbor did both. That is why, more than two decades later, the Arbor DDoS product line remains the reference stack at most global ISPs.

Founding story: Farnam Jahanian's lab and the DARPA roots

Arbor Networks was founded in 2000, spun out of University of Michigan research led by Farnam Jahanian, then a U-M computer science professor, and Robert Malan, a PhD student in the same research group. The foundational work was funded in part by DARPA. The research problem was direct: how do you detect and mitigate large-scale distributed denial-of-service attacks in real time? Distributed attacks were a relatively new problem at the turn of the millennium, and the classical network security stack was not equipped to handle them at carrier scale.

Arbor productized the Michigan research. The company grew through the early 2000s as DDoS attacks became a regular operational concern for ISPs, telecom carriers, and large enterprises. Arbor's product became the tool those operators bought. The company expanded engineering and operations in Burlington, Massachusetts alongside the Ann Arbor engineering team, which gave the company a bicoastal R&D base while keeping the founding culture in Michigan.

Jahanian himself went on to one of the most consequential career arcs in US research policy. He served as head of the National Science Foundation's Computer and Information Science and Engineering Directorate (NSF CISE), then became provost and president of Carnegie Mellon University. He remains one of the most cited figures in the Ann Arbor cybersecurity lineage. Dug Song, who later co-founded Duo Security, spent seven years as Arbor's chief security architect before starting Duo. The Arbor-to-Duo talent pipeline is the single most important structural driver of the modern Ann Arbor security cluster.

Acquisition history

Corporate ownership has moved twice. Danaher acquired Arbor in 2010 and folded it into its Communications platform. In October 2014 NETSCOUT announced a deal to acquire Danaher's Communications business, including Arbor Networks, at a headline value of approximately $2.6 billion. The deal closed in July 2015 at roughly $2.3 billion in transaction value. Arbor has operated as a NETSCOUT business line since.

NETSCOUT has retained the Ann Arbor engineering operation. Specific current headcount is not disclosed. The Arbor DDoS product line continues to ship new versions, continues to serve carrier customers, and continues to employ Michigan engineers. The product family has been folded into NETSCOUT's broader network observability and security portfolio, with Arbor Sightline, TMS, and Edge Defense remaining core SKUs.

Ann Arbor footprint

Arbor's original Ann Arbor presence was the engineering and research center of gravity for the company. After the 2010 Danaher and 2015 NETSCOUT transactions, the Ann Arbor footprint contracted in some areas and continued in others. Specific current headcount inside NETSCOUT is not publicly disclosed.

The cultural and lineage footprint, however, is enormous and ongoing. Multiple downtown Ann Arbor security companies trace founder pedigree, early hire pedigree, or technical mentorship lineage back to Arbor Networks. The Arbor alumni network shows up consistently in cap tables, advisor lists, and board roles across the Ann Arbor security scene.

The Arbor-to-Duo lineage

Dug Song spent seven years as Arbor Networks' chief security architect before co-founding Duo Security in 2010. That single transition is the most consequential career move in modern Ann Arbor cybersecurity history. Song carried the technical credibility of an Arbor leadership role, the engineering relationships built across years inside Arbor, and the conviction (informed by what he saw at Arbor) that the next big security primitive was identity, not network.

The Arbor lineage to Duo is well-documented but it is not the only one. Censys was founded by U-M faculty and researchers operating in the same broader academic security community that produced Arbor. Blumira's investor and advisor base includes Duo and Arbor alumni. Multiple smaller Ann Arbor security and SaaS companies have founders, principal engineers, or early product leadership with Arbor Networks lines on their resumes.

Why it matters for Ann Arbor tech

The DDoS market has matured. The structural demand for carrier-grade detection and mitigation remains, and the Arbor product line is well-entrenched at most major ISPs globally, which makes the revenue base stable. The growth story is different. Pure-play DDoS protection has been partially absorbed into broader network security and observability bundles, both by NETSCOUT itself and by competitors like Cisco, Radware, F5, and cloud-native DDoS services from AWS Shield, Cloudflare, and Google Cloud Armor.

For Ann Arbor specifically, Arbor's significance is less about current employment and more about historical lineage. Duo Security was founded in 2010 by a former Arbor chief security architect. Censys was founded in 2017 by U-M faculty operating in the same research community that originally produced Arbor. Blumira was founded by people who learned their craft in this cluster. The Arbor Networks alumni network is the most important single feeder into Ann Arbor cybersecurity, period.

When founders ask why Ann Arbor produces so much cybersecurity talent, the short answer is U-M's CS and EECS departments. The long answer is that Farnam Jahanian's lab and Arbor Networks built the local industry from raw academic research, employed a generation of security engineers in Michigan, and exported them across the ecosystem when the company changed hands. Most of the cluster's downstream successes can be traced to this single lineage.

Hiring inside NETSCOUT

NETSCOUT hires network engineers, software engineers (C and C++ heavy for the packet-processing components, Go and Python for tooling and services), threat researchers, and product managers for the Arbor-lineage products. The Ann Arbor office has historically been the engineering center of gravity for the Arbor DDoS line. Compensation is competitive with other mid-cap public security vendors and with the Ann Arbor senior software engineer band, but below FAANG and below well-funded late-stage private security companies.

Work model varies by role. Engineering roles associated with Arbor products in Ann Arbor operate on hybrid or in-office schedules. Specific remote availability varies.

Related

  • Duo Security is the flagship Ann Arbor cybersecurity employer, founded by an Arbor Networks alum (Dug Song, who spent seven years as Arbor's chief security architect before starting Duo).
  • Censys is the U-M spinout internet intelligence company, born out of the same broader academic security community that produced Arbor.
  • Blumira is the cloud SIEM and XDR for mid-market IT, with backing and advisory ties to the Arbor and Duo alumni network.
  • Ann Arbor cybersecurity companies is the category hub.
  • Ann Arbor tech companies is the master directory.

FAQ

Who founded Arbor Networks? Arbor Networks was founded in 2000 by Farnam Jahanian, a University of Michigan computer science professor, and Robert Malan, a PhD student in the same research group. The company was spun out of U-M with DARPA-funded research roots.

Is Arbor Networks still in Ann Arbor? Yes. The Ann Arbor engineering operation has continued through two acquisitions. Specific current Ann Arbor headcount inside NETSCOUT is not publicly disclosed.

When did NETSCOUT acquire Arbor Networks? NETSCOUT announced the acquisition of Danaher's Communications business, which included Arbor Networks, in October 2014 at a headline value of approximately $2.6 billion. The deal closed in July 2015 at roughly $2.3 billion in transaction value.

What happened to Arbor Networks' founder Farnam Jahanian? Farnam Jahanian went on to serve as head of the NSF's Computer and Information Science and Engineering Directorate, and later became provost and then president of Carnegie Mellon University. He is still widely referenced as the professor who started Ann Arbor's cybersecurity cluster.

What is Arbor Sightline? Arbor Sightline is a network-wide traffic visibility and anomaly detection platform that is widely deployed at major ISPs. It ingests NetFlow, sFlow, and BGP data from carrier and enterprise networks, correlates it in real time, and identifies DDoS attacks and traffic anomalies.

How are Arbor Networks and Duo Security related? Dug Song, who co-founded Duo Security in 2010, spent seven years as Arbor Networks' chief security architect before leaving to start Duo. The Arbor-to-Duo talent flow is one of the most important lineages in Ann Arbor cybersecurity.

Does NETSCOUT still invest in the Arbor DDoS product line? Yes. Arbor DDoS products continue to ship new versions and serve carrier and enterprise customers. The product line faces competitive pressure from cloud-based DDoS mitigation services but retains strong incumbency at major ISPs.