A WAF is to buy you time to fix your application. It isn't a bulletproof situation. For example if you discover a vulnerability in your code that is being expl

A WAF is to buy you time to fix your application. It isn't a bulletproof situation. For example if you discover a vulnerability in your code that is being exploited you can push a WAF rule to block the easiest ways to trigger it. Or if you use a common library like log4j you can rely on rulesets that are updated for you. Likely before your smaller team has time to react. In that time you should be rushing to fix your application or update dependencies and deploy the new version.