Hot take on WAFs... Your application has to be made secure, the WAF cannot do it for you. At best a third party managed WAF provides speed for sticking plaste

Hot take on WAFs... Your application has to be made secure, the WAF cannot do it for you. At best a third party managed WAF provides speed for sticking plaster to be put over a newly discovered vulnerability, but as all WAFs can essentially be thought of as advanced string parsing without the context of what your app thinks of as good or bad, then there will always be some false negatives that affect your app. Security engineering cannot be purchased as an afterthought, it needs to be something your engineers practise as commonly as observability and testing.