What is the difference between 'on-demand' and 'always-on' DDoS Guard Loop VPN protection?

'On-demand' protection is activated only when an attack is detected, which can result in a short period of vulnerability during the detection phase. 'Always-on' protection continuously routes all traffic through the scrubbing centers, providing immediate mitigation and a more proactive defense. Always-on is generally preferred for critical services, while on-demand can be a cost-effective option for less sensitive applications.