WAF are a bad idea imvho. They can give a false sense of security and the feeling that security is being taken care of. The reality is theta they are generally not very good at catching anything other than the most basic of attacks.
I much prefer
- external security monitoring (there are many vendors)
- automated testing in pre production using skipfish/w3af/whatever
- static code analysis
- penetration testing
- responsible disclosure programmes
- hackdays
I much prefer
- external security monitoring (there are many vendors) - automated testing in pre production using skipfish/w3af/whatever - static code analysis - penetration testing - responsible disclosure programmes - hackdays