‘Always-on’ and ‘On-demand’ are two opposite terms referring to the DDoS mitigation cloud service. In an Always-on deployment, the service or network is constantly being protected by the DDoS mitigation service, while in On-demand there is no protection most of the time, and the DDoS mitigation layer is inserted only under a DDoS attack or severe threat.
For example, when using DNS diversion, the clients reach the protected service directly and only under an attack. The DNS records are being changed to direct all traffic to the DDoS service provider.
Always-on protection is much faster and more reliable under attack, while an On-demand deployment advantage is that the DDoS layer is used only when needed and is commonly cheaper.