Mitigation cutover is the step that moves traffic off its normal path and onto a scrubbing path once an attack is detected. Whether that switch happens fast enough, and whether the service still works on the other side of it, is what a DDoS test times. It only exists in an on-demand model: in always-on mode traffic already flows through the scrubbing tier, so there is nothing to switch.
How the switch is made
There are two levers, and they behave differently.
The BGP lever moves a whole network. The scrubbing provider announces your prefix from its own autonomous system, routers across the internet converge on the new path, usually within tens of seconds to a few minutes, and clean traffic is handed back over a GRE tunnel or a direct interconnect. It has hard preconditions. Most networks ignore IPv4 announcements longer than a /24 (a /48 for IPv6), so a service that lives in a smaller block cannot be diverted this way at all. And if the prefix already has route origin authorisations, the provider's autonomous system must be authorised in one; otherwise networks that validate RPKI treat the announcement as invalid and keep sending traffic the old way.
The DNS lever moves one hostname. The record is changed to point at the provider, and traffic follows as cached answers expire, which is as fast as the TTL and slower wherever resolvers hold answers longer than told. It also has a blind spot BGP does not: an attacker who already knows the origin address never looks the name up again, so origin IP exposure makes a DNS cutover protect everyone except the attacker.
The trigger is the third part. Either flow telemetry crosses a threshold and the diversion is automatic, or a person calls the provider and approves it, and the second option is often the slowest minute in the whole sequence.
What breaks on the far side
A cutover can complete and still cause an outage. The common cause is the tunnel: GRE adds 24 bytes of headers, so a 1500-byte path becomes 1476, and unless the TCP maximum segment size is clamped to fit, large responses are silently dropped while small health checks pass. The site looks up and pages half-load.
Routing can also become asymmetric, with requests arriving through the scrubber and replies leaving directly, which a stateful firewall at the origin may refuse. Then there is the way back. Withdrawing the diversion the moment the attack drops invites a pulse-wave attacker to resume, which is why providers often hold a diversion in place for a while after the traffic subsides.
What a DDoS test measures
A test runs the cutover for real and times each part: trigger to announcement, announcement to traffic arriving at the scrubber, and arrival to clean traffic reaching the origin. Those intervals feed the larger time-to-mitigation figure.
It also checks what a timer cannot. Do large responses survive the tunnel? Does the origin accept traffic arriving from the provider's ranges? Does anything still reach the origin by the old path? Then it times the cut-back, because a switch that cannot be safely reversed is only half tested.
The same reasoning applies to rehearsing who makes the call to divert and how long that takes, which DDoS Tabletop Exercise works through.