I think that important difference though. WAFs are very useful when they are used as a quick fix for a zero-day vulnerability. Especially if you are running som

I think that important difference though. WAFs are very useful when they are used as a quick fix for a zero-day vulnerability. Especially if you are running some generic software like WordPress and can subscribe to a managed WordPress rule set. The key is that they should mitigate specific vulnerabilities and ideally once the proper fix is deployed the rules are then removed from the WAF. WAFs have near-zero value for things like trying to detect shell-code or generic SQL injections as they just turn into fuzzy bug injectors. Any real attacker will very quickly find a way to structure their exploit to avoid the heuristics. WAFs also have minimal value for custom software. Because even if you use it to deploy a quick block for an exploit unless you are just blocking a whole endpoint the attacker will also likely find a way to work around it.