I cannot argue with this too much. A WAF will protect you from unsophisticated attackers - at great cost. In my group, I am considered to be the WAF SME. Eno

I cannot argue with this too much. A WAF will protect you from unsophisticated attackers - at great cost. In my group, I am considered to be the WAF SME. Enough that I wrote a training course to get into ruleset tuning. What I see a lot is customers who are security-focused demanding "OWASP Top 10" protection and then, somehow, not understanding that it is not 10 rules you enable on the WAF. These are people often with application security and other credentials. Most people I have seen running WAF's are in "Set it and forget it" mode. Tune the rules until it no longer blocks legitimate traffic and call it a day. I think few really understand what it is, and the why of using them. Another funny anecdote: I had one of these customers talk about how amazing Akamai WAF was, because it never had false positives. Never? Really? That looks like a red flag to me, but they were not concerned.