DDoS scrubbing: Zetvest and Nexusguard keep Malaysia’s traffic in-country
On 5 October 2026, at the CyberDSA 2026 security event in Kuala Lumpur, Malaysian cybersecurity provider Zetvest Sdn Bhd signed a memorandum of understanding to become Nexusguard’s Authorized Managed Security Service Provider (MSSP) for Malaysia. Under it, Zetvest is rolling out a fully managed, national-level DDoS scrubbing centre. It runs on Nexusguard’s Bastions technology with 200Gbps of capacity, and it cleans attacks on Malaysian networks inside the country.
The release names no contract value, no term and no customer. The centre targets government agencies, banks and telecommunications providers that require strict data sovereignty. The more interesting story is why anyone builds a scrubbing centre — a piece of network plumbing usually sited wherever bandwidth is cheapest — with national borders as a design constraint.
What the deal is
DDoS scrubbing works by diverting a network’s traffic to a specialised facility, stripping out attack traffic, and returning the clean flow. Nexusguard’s model pairs an on-premise Bastions appliance with a global cloud of scrubbing centres; when an attack exceeds local capacity, the provider reroutes traffic to the cloud and cleans it there.
In Malaysia, Zetvest becomes the authorised MSSP: its local security operations centre will run the service round the clock, and the centre will cover both network infrastructure (Netshield) and web applications (Appshield). The mechanics matter to the sovereignty argument. DDoS scrubbing typically works through the internet’s routing system: when an attack is detected, the network announces the attacked address space to a scrubbing provider, which pulls the traffic in, filters out the malicious flow and returns what is legitimate. Where that filtering happens — in which country, under whose jurisdiction — is a policy choice as much as an engineering one. A domestic centre keeps the diversion inside the national perimeter. Zetvest cleans all traffic domestically, which is the point — the release says the facility will let attacks be “intercepted and cleaned right here in Malaysia”.
Why in-country scrubbing matters
Data sovereignty has been a cloud-storage argument for a decade. It is now becoming a security one. When a bank or a government agency diverts its traffic for cleaning, that traffic leaves the country — and for critical national infrastructure, that can conflict with regulatory and compliance requirements about where sensitive traffic may travel. In-country scrubbing resolves the conflict by keeping the diversion domestic.
There is a second benefit beyond compliance. A nearby scrubbing centre can return clean traffic with lower latency than a facility on another continent, which matters for services that need to stay responsive under attack. Sovereignty and performance pull in the same direction here, which is unusual and makes the case easier to argue. The driver is explicit in the release: government agencies, banks and telcos that “require strict data sovereignty”. Malaysia’s context sharpens the case. The country has built a formal critical national information infrastructure framework, and CyberSecurity Malaysia coordinates protection across it. For the operators inside that framework — utilities, finance, government services — an attack is not just an IT incident; it is a potential outage of something the public depends on. A scrubbing centre designed around their sovereignty requirements speaks directly to how those operators are expected to be defended.
Leadership from CyberSecurity Malaysia, the national agency, witnessed the signing, which it frames as part of a collaboration programme. The message is that Malaysia’s data should stay in Malaysia — the same principle that has driven sovereign-cloud projects across the region, applied to attack mitigation rather than storage.
The threat it answers
The demand is not hard to explain. DDoS attacks remain one of the most persistent and disruptive tactics on the internet, and the largest are getting larger. Cloudflare’s DDoS Threat Report for the first half of 2026 says it mitigated 23.2 million network-layer attacks in six months — about 5,343 an hour — and 935 attacks exceeding one terabit per second, 805 of them in the second quarter alone, a sixfold quarter-on-quarter rise. DNS-based attacks made up 34.3% of network-layer activity, and CLDAP floods surged.
Most attacks, though, are small: 96.62% stayed below 500Mbps and 90.60% ended within ten minutes. That matters for sizing a defence, because a 100Gbps attack can knock most unprotected data centres offline, while a 1Tbps-plus attack stresses even major internet infrastructure. Akamai’s 2026 report adds that application-layer DDoS attacks rose 104% over 2023–2025, with Asia-Pacific a frequent target. A national scrubbing centre is a reasonable answer to the ordinary end of that range — the frequent, mid-sized attacks that overwhelm unprotected networks. The attacks also rarely arrive alone. A DDoS burst is often a distraction for something else — an intrusion attempt, a data exfiltration, a ransomware deployment — which means the mitigation service has to integrate with the rest of a security operations centre rather than sit apart. That is an argument for the managed model Zetvest is selling: the scrubbing is one capability inside a broader defence.
The scale question
The release says the centre is “built on dedicated Nexusguard Bastions hardware to absorb even the heaviest volumetric attacks”. At 200Gbps, that claim needs context. The largest recorded attacks now exceed a terabit per second, several times the centre’s capacity, so a 200Gbps facility cannot absorb the heaviest attacks on its own. It can handle local and mid-sized events in-country and fall back to Nexusguard’s global cloud for the largest — which is exactly how the “global plus local” model is designed to work.
There is also a figure to treat carefully. The release describes Nexusguard’s network as “over 84 scrubbing centers”; Nexusguard’s own public pages have cited “more than 40”. The discrepancy may reflect growth or a broader definition, but as written the two numbers do not match, and the release does not reconcile them. Both are company figures; neither is independently audited.
The MSSP model
The deal fits a pattern Nexusguard has run before. It partnered with 21st Century Technologies to build a DDoS scrubbing centre in Nigeria and with Link Net in Indonesia, each time pairing its global cloud with a local operator’s infrastructure and relationships. The logic is that a local partner can sell to domestic enterprises and government, run the service, and provide the in-country presence that a foreign vendor cannot — while the vendor supplies the technology and the global scrubbing capacity.
For Zetvest, an MSSP specialising in “sovereign digital defense” with homegrown products for credential protection and attack-surface management, the appointment extends its portfolio from prevention and management into mitigation. The MSSP role also means the customer buys a managed service rather than hardware, which lowers the barrier for organisations that lack a security operations team of their own.
The Economics Explain
The economics explain why this is a partnership rather than a solo build. Scrubbing centres are capital-heavy: they need routers, high-capacity links, packet-processing systems, monitoring and round-the-clock staff, all sized for peak attacks that may arrive rarely. A global vendor spreads that cost across many markets and sells the local partner a managed service; the partner brings the customers, the operations centre and the in-country presence. That division is what makes a national facility viable for a mid-sized operator. The competition is real. Cloudflare, Akamai Prolexic, Vercara, Imperva and Radware lead the scrubbing market, and hyperscalers offer their own protections.
Global providers argue the opposite trade-off: that the largest networks, sited close to attack origins and interconnected with many carriers, absorb the biggest attacks more reliably than any single national facility can. The truth is that most organisations need both — in-country DDoS scrubbing for everyday events and regulatory comfort, and a global cloud for the record-size attacks that no local centre is built to take alone. Nexusguard’s pitch is not to beat them on global scale but to specialise in the operator and sovereign segment — a regional provider may value a nearby scrubbing centre and a local partner more than a larger headline number.
What to watch
For Zetvest and Nexusguard, the test is whether the MoU becomes a signed service with named customers and disclosed capacity commitments, and whether the centre handles attacks at the scale it advertises. For Malaysian critical infrastructure, the question is whether in-country scrubbing measurably improves resilience without adding latency or cost. And, for the wider region, the deal is another sign that data sovereignty is migrating from storage policy into security architecture. In-country DDoS scrubbing is the clearest example yet of that shift.
What the announcement does and doesn’t establish
It establishes an MSSP appointment, a named technology partner and a clear rationale. It does not establish a signed commercial contract or any customer, and it does not show that a 200Gbps centre can absorb the attacks now being launched. Moreover, it is a sovereignty-first security build in a market where the attacks are growing faster than most defences.
The honest summary is that Malaysia now has a plan to clean attack traffic inside its own borders — a sensible answer to a real requirement, resting on a memorandum of understanding and a capacity figure that the next record attack will test.
Editor’s Note: This article draws on the company’s announcement and public product materials, plus independent DDoS threat data from Cloudflare and Akamai and public research on scrubbing. The centre’s capacity, Nexusguard‘s network size and the partnership’s commercial terms are through a company-report and no independent verification; the release names no customer or contract value. No interview by TechRecast. See the source list in the publication package.