One thing we left out: automatic defense has a false-positive circuit breaker. If too many IPs that previously passed a challenge get mitigated, or the success rate of normal requests drops past a threshold, automatic mitigation for that site drops back to the lowest level (L1) and you get notified. If it trips repeatedly within 24 hours, an admin has to restore it by hand.