CMDashCybersecurity Maturity Dashboard

← All landscape areas

Application Security · Core

Web Application Firewall (WAF)

Filters malicious web application requests.

8 options listedTypical cost: $2k-$60k/yrPROTECT (PR)

Overview

WAFs inspect HTTP(S) traffic to block injection, XSS, bot abuse, and OWASP Top 10 attacks in front of apps and APIs. Delivered as cloud, appliance, or host module, frequently bundled with CDN/DDoS. Cost scales with traffic, sites, and rule sophistication. Managed rule tuning reduces false positives.

Needed for any internet-facing application.

Advantages

Cloudflare easy with bundled DDoS/CDN value
Imperva/F5 deep enterprise rule sets
ModSecurity/Coraza free
blocks OWASP Top 10.

Trade-offs

False positives can break apps without tuning
advanced bot/L7 protection is a higher tier
OSS requires rule expertise.

Vendors & tools in this area

CloudflareCommercial

Edge platform: WAF, DDoS, ZTNA, DNS; strong value, dev-friendly.

AkamaiCommercial

Massive CDN/edge: DDoS, WAAP, API and segmentation.

ImpervaCommercial

Enterprise WAF + data security + DDoS.

F5Commercial

App delivery + advanced WAF (BIG-IP / Distributed Cloud).

AWS WAFCommercial

Native, pay-as-you-go web application firewall.

ModSecurityOpen source

Classic open WAF engine.

CorazaOpen source

Modern Go WAF (ModSecurity-compatible).

Fastly Next-Gen WAFCommercial

Edge/on-prem/cloud-deployable WAF (formerly Signal Sciences) with request-based pricing and built-in API/bot protection.

Start free trial Browse the full atlas

Web Application Firewall (WAF) — Cybersecurity Landscape Atlas — CMDash