> actual security does not matter What matters, of course, is money. Only if the WAFs themselves become a significant attack vector, to the extent where blame

> actual security does not matter What matters, of course, is money. Only if the WAFs themselves become a significant attack vector, to the extent where blame for breaches affects the bottom lines of the WAF vendors, the situation will start to change.