Might I suggest a little research, e.g., reading http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf http://cs.unc.edu/~fabian/course_papers/PtacekNewsh

Might I suggest a little research, e.g., reading http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf This points out how WAF/NIDS is just a speed bump for a serious attacker. You may conclude that they don't really 1) remove attack surface 2) Unclear if they really do this, and if they do what value there is 3) See the papers for detail on the differences 4) Zero cost to purchase, but what cost to maintain, run, keep up? 5) see #4 6) even if you have a large web farm? This paper was writen 20 years ago.