WAFs were a band aid over web services that security teams couldn't control or understand. They fell out of favor because of performance and the real struggle tuning these appliances to block malicious traffic effectively.
WAF based approach is an admission of ignorance and a position of weakness, only in this case shifting right into the model is unproven, can't quite be done yet, contrary to ideas like reactive self protection for apps.
WAF based approach is an admission of ignorance and a position of weakness, only in this case shifting right into the model is unproven, can't quite be done yet, contrary to ideas like reactive self protection for apps.