Table of Contents
On November 4, Medianova CEO Serkan Sevim presented at the Future of AI and Cloud summit at Mandarin Oriental Bosphorus in Istanbul. The room was full of CXOs and infrastructure leaders from across the region. The talk ran 20 minutes. The argument it made will take most organizations considerably longer to fully reckon with.
The core claim: the CDN is evolving. Not because delivery stopped mattering, but because the edge has become something far more consequential than a caching layer. It is now the first place traffic lands, the first place attacks are absorbed, and the only place where real-time intelligence about your infrastructure actually lives. The question is whether you are reading that intelligence or letting it disappear into logs that no one has time to open.
This post covers the key ideas from the talk. You can download the full slide deck below. Fill in the form, and we will send it to your inbox.
Your Majority User Has No Eyes
Serkan opened with a number that reframes every assumption most engineering teams have about who they are building for.
In 2024, 51 percent of all web traffic was automated. For the first time in a decade, machines outnumbered humans. Of that automated traffic, 37 percent was bad bots, and 14 percent was good bots. Only 49 percent of requests came from actual people.
Source: Imperva Bad Bot Report 2025 (2024 data)
This is not a security slide. It is an architecture slide. If your edge was designed around human browsing patterns, you optimized for the minority. Caching strategies, rate-limiting logic, WAF rules, and observability dashboards built around human traffic patterns will read automated traffic as anomalies, miss attacks that look like normal behavior, and produce metrics that don’t reflect what is actually happening on your infrastructure.
New attack techniques emerge every day, and they are designed to look like legitimate automated traffic. The edge is where you have to tell them apart. If your edge cannot see the difference, neither can anything downstream.
The Category Has Already Moved
The CDN industry has gone through three distinct phases, and the third is not on the horizon. It is already underway.
Era one was delivery. Move bytes faster. Latency wins. Era two was protection. WAF and DDoS absorption became table stakes. Era three is intelligence: seeing, understanding, and acting on edge data in real time.
Gartner no longer uses the term CDN. The analyst firm has renamed the category to Edge Distribution Platform.
To illustrate where the revenue follows the category shift, Serkan referenced the company that invented the CDN industry. Its 2025 revenue was $4.21 billion. Security made up 53 percent. Delivery was 30 percent. Compute was 17 percent, growing at 12 percent year over year.
The category leader is already majority security and compute. Delivery is always the foundation, but it is now a third of the business and shrinking in relative terms. Any organization still treating its CDN vendor purely as a delivery tool is operating on a model the market has already revised.
The Problem: Your Edge Data Is a Black Box
The core operational problem Serkan addressed is one that most infrastructure teams recognize the moment they hear it named.
Your CDN generates telemetry on every request: cache decisions, response codes, origin behavior, latency by region, bot classifications. This data exists. It is being collected. In most organizations, almost none of it is being read.
65 percent of edge telemetry goes unanalyzed.
The reason is not lack of interest. It is friction. To get a useful answer out of raw CDN logs, you need SQL, you need a senior engineer, and you need time. When something breaks, you have none of those. You open Grafana, see that something happened, and spend the next several hours trying to find out why. Grafana tells you what happened. It cannot tell you why.
The business consequence of that gap is not abstract. The average time for an organization to identify and contain a data breach is 241 days. The average cost of that breach is $4.44 million.
Engineers spend hours digging through logs instead of building products. Terabytes of telemetry get collected and never analyzed. And when something goes wrong, the time between the incident and the answer is measured in hours, not seconds.
The Shift: From Dashboards to Intelligence
The talk laid out what changes when you replace static dashboards with active intelligence. The contrast is not subtle.
Before: static Grafana dashboards, manual log investigation, reactive response after users have already noticed the problem, SQL queries that only senior engineers can run.
After: natural language queries on live edge data, AI-powered root cause analysis, proactive anomaly alerts before users are affected, and any team member able to query CDN data without writing a line of code.
This is not a tool upgrade. It changes who can participate in infrastructure observability and how fast an organization can move when something goes wrong.
What This Looks Like in a Real Incident
The presentation included a live product demonstration using data from MBC Shahid, the streaming platform serving viewers across the MENA region.
A team member asked the system a plain-language question: “Why did our error ratio increase to 4 percent between 14:00 and 15:30 today?”
The response came back in seconds.
Root cause identified: a configuration change at 13:55 had updated the TTL for /api/v2/* paths from 3,600 seconds to 0 seconds, causing 23,400 additional origin pulls in a 90-minute window. The Frankfurt PoP cache ratio had dropped from normal levels to 41 percent. Origin load had spiked 340 percent.
The recommendation: revert the TTL on /api/v2/* to 3,600 seconds. Estimated recovery time: under 8 minutes.
No SQL. No log triage. No senior engineer pulled away from a sprint. The question was asked in plain language and answered in seconds with a specific, actionable recommendation.
That is the gap between a dashboard and intelligence.
What Your Team Can Do on Day One
The slide deck outlines four categories of immediate edge intelligence use cases.
- Real-time diagnostics: ask why latency spiked in a specific region at a specific time and get the root cause in seconds instead of hours.
- Anomaly detection: when bandwidth deviates from baseline by a configured threshold, get an alert before your users notice.
- Business intelligence: cost per GB broken down by content type, revenue at risk per PoP, efficiency scores across your edge footprint.
- Auto-generated reports: monthly edge performance summaries formatted for a board audience, produced on demand without an analyst building the spreadsheet.
The Architecture Behind It
One slide in the deck shows the before-and-after of edge architecture in a way that makes the old model’s structural risk immediately clear.
Before: every origin is directly reachable from the internet. WAF rules, rate limiting, and logging are configured application by application. A new threat means patching every app, every config, and every team.
After: Medianova Edge sits in front of everything. TLS termination, WAF, DDoS absorption, rate limiting, and caching all happen at the edge before a single request reaches the origin. Origins are private. EdgeSight collects one unified data stream across the entire footprint.
The observability is not an add-on. It is a property of the architecture. When the edge handles everything, everything that happens there is visible.
Proof at Production Scale
Medianova currently runs 60+ PoPs across 25+ active countries, with over 2 Tbps of capacity in Turkey.
One example from the presentation: a Turkish e-commerce platform saw 74 percent faster time to first byte and 91 percent faster page load after moving to Medianova. Over 20 million attacks were blocked with zero downtime.
The platform serves 230+ enterprise customers, including major video platforms and broadcasters across the MENA region.
What Comes Next: Compute at the Sovereign Edge
The final section of the talk covered what Medianova is building toward.
Today: edge delivery, WAF and DDoS protection, Origin Shield, and real-time observability through EdgeSight.
On the near horizon: Medianova Workers. Serverless compute that runs at the edge, deployable across 60+ global PoPs, with the option to keep data and execution in-country.
For enterprises operating under data residency requirements in Turkey, across the MENA region, or inside the EU, running inference and business logic at the edge without crossing borders is not a differentiator. It is a compliance requirement. The sovereign edge is where AI workloads go when jurisdiction matters.
Three Questions for Tomorrow Morning
Serkan closed the talk with three questions he asked the audience to bring back to their teams the next day.
- Is your origin reachable directly from the internet?
- Do you get notified when something goes wrong, or do you find out from a user?
- How fast can you see what happened at your edge in the last 60 seconds?
If any of those answers are uncomfortable, that is where the work starts.
Medianova offers a free EdgeSight Assessment: two weeks, no cost, and it works alongside your current CDN. You do not have to migrate anything to start seeing your edge data clearly.
Get the Full Presentation
The full slide deck from Future of AI and Cloud 2026 includes the complete architecture breakdown, the EdgeSight product demonstration with the MBC Shahid example in full, the production proof metrics, the roadmap for Medianova Workers, and Serkan’s three-question self-assessment framework.
Fill in the form below, and we will send it to your inbox.
