> WAF based approach is an admission of ignorance and a position of weakness Sure, but what about the benefits? Let's say you've got an ecommerce website, and

> WAF based approach is an admission of ignorance and a position of weakness Sure, but what about the benefits? Let's say you've got an ecommerce website, and you find XSS. Without a WAF that would be a critical problem, fixing the problem would be an urgent issue, and it'd probably be a sign you need to train your people better and perform thorough security code reviews. You'll have to have an 'incident wash-up' and you might even have to notify customers. If you've got a WAF, though? It's not exploitable. Give yourself a pat on the back for having 'multiple layers of protection'. The problem is now 'technical debt' and you can chuck a ticket at the bottom of the backlog and delete it 6 months later while 'cleaning up the backlog'. /s