Index › Network and edge › September 2026 Edition

Web application firewalls

Asked as “web application firewall”, and as “WAF and bot protection service”, on behalf of a mid-market B2B company. 44 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.

Standing

Cloudflare

Clear leader

55% of first choices, clear leader.

ShowinginAll 67 categories in the September 2026 Edition →

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

Small business

Cloudflare73%Clear leaderStanding →Mid-market

Cloudflare55%Clear leaderThis page Enterprise

Cloudflare27%ContestedStanding →

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a mid-market B2B company. Ordered by share.

ProductFirst-choice shareNegative rateLabelsQuadrant

Cloudflare0%33endorsed leader

Cloudflare WAF11%27endorsed leader

AWS WAF13%38accepted challenger

Fastly10%10accepted challenger

Show the four products at 0%, ordered by negative rate

ModSecurity56%18criticized challenger

Imperva37%27criticized challenger

Akamai27%22criticized challenger

Barracuda20%15accepted challenger

Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

Head to head

Cloudflare vs Cloudflare WAF Cloudflare vs AWS WAF Cloudflare WAF vs AWS WAF

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default

Negative label rate →

Accepted challengerEndorsed leader

0%First-choice share → · lines at 30% share and 25% negative70%

Key

Cloudflare55%

Cloudflare WAF34%

AWS WAF5%

Fastly2%

Barracuda0%

Akamai0%

Imperva0%

ModSecurity0%

02What they warned about

Three of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.1 Fast, DeepSeek V4 Flash, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.

ModSecurity

56%

10 of 18 labels negative · 8 of 12 models · 2 hard negative

“Avoid: Unmanaged Open Source (ModSecurity/CoreRuleSet) ... Do not install this unless you have a dedicated security engineer” Qwen 3.7 Flash, negative prompt

Imperva

37%

10 of 27 labels negative · 6 of 12 models · 2 hard negative

“**Avoid assuming Imperva's signature protections are sufficient** — independent tests show they miss most attacks.” DeepSeek V4 Flash, negative prompt

Akamai

27%

6 of 22 labels negative · 5 of 12 models · 1 hard negative

“Why Not Akamai or Enterprise F5 for Mid-Market? ... you're paying for capacity you don't need.” Kimi K2, paraphrase prompt

AWS WAF

13%

5 of 38 labels negative · 4 of 12 models

“Out of the box, AWS WAF is essentially a blank canvas... It requires deep cloud-engineering expertise to manage, meaning high operational overhead” Gemini 3.5 Flash, direct prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

62 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 749 links across 185 sites, every framing counted. Ranked by the number of answers carrying the site or page.

cybersecuritynews.com

31 answers · 47 citations · 10 models

openappsec.io

vendor site · open-appsec31 answers · 46 citations · 10 models

cyberpress.org

30 answers · 30 citations · 10 models

wafplanet.com

26 answers · 45 citations · 9 models

expertinsights.com

vendor site · Expert Insights25 answers · 25 citations · 10 models

imperva.com

vendor site · Imperva16 answers · 18 citations · 8 models

geekflare.com

15 answers · 16 citations · 8 models

radware.com

vendor site · Radware13 answers · 25 citations · 6 models

aimultiple.com

13 answers · 14 citations · 7 models

indusface.com

vendor site · Indusface10 answers · 13 citations · 6 models

fastly.com

vendor site · Fastly10 answers · 11 citations · 6 models

akamai.com

vendor site · Akamai9 answers · 23 citations · 7 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

cyberpress.org/waf-solutions-by-business-size

29 answers · 10 models

expertinsights.com/network-security/the-top-web-application-firewalls

25 answers · 10 models

openappsec.io/post/best-waf-solutions-in-2024-2025-real-world-comparison

23 answers · 7 models

cybersecuritynews.com/best-web-application-firewall-solutions

17 answers · 8 models

wafplanet.com/

17 answers · 8 models

cybersecuritynews.com/best-web-application-firewall-solutions/amp

15 answers · 9 models

geekflare.com/cybersecurity/best-web-application-firewall

15 answers · 8 models

openappsec.io/post/best-waf-solutions-in-2026-real-world-comparison

15 answers · 9 models

cybersecuritynews.com/best-web-application-firewall-waf

14 answers · 7 models

aimultiple.com/waf-solutions

12 answers · 7 models

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.

ModelDirect“What is the best web application firewall for a mid-market B2B company?”Paraphrase“Which WAF and bot protection service would you recommend to a mid-sized B2B company?”Comparative“What are the top web application firewalls and how do they differ?”Budget-constrained“What is the best web application firewall for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a web application firewall. What should we look at?”Negative“Which web application firewalls should I avoid or be cautious about?”

Claude Haiku 4.5AWS WAF, Cloudflare WAF

One alternative

Fortinet FortiWAF

against: ModSecurity, Palo Alto Networks Prisma Cloud WAFCloudflareChanged

Two alternatives

AWS WAF, Barracuda

against: ImpervaCloudflare

Five alternatives

AWS WAF, Akamai, Azure WAF, Fastly, Imperva

Cloudflare WAF

Three alternatives

AWS WAF, Fortinet FortiWeb, ModSecurity

no first choicenothing named

GPT-5.4 miniCloudflare WAF

Three alternatives

AWS WAF, Akamai App & API Protector, F5 Distributed Cloud WAF

Cloudflare WAF + Cloudflare Bot ManagementChanged

Three alternatives

Akamai, Fastly Next-Gen WAF, Imperva

Cloudflare WAF

Six alternatives

AWS WAF, Coraza, F5 BIG-IP Advanced WAF, Imperva WAF / Application Security, Microsoft Azure WAF, ModSecurity

Cloudflare WAF

One alternative

AWS WAF

no first choicenothing named

Gemini 3.5 FlashCloudflare WAF

Two alternatives

Fastly Next-Gen WAF, Imperva Cloud WAF

against: AWS WAFCloudflareChanged

Two alternatives

DataDome, Fastly Next-Gen WAF

Cloudflare WAF

Five alternatives

AWS WAF, Akamai App & API Protector, F5 Advanced WAF & Distributed Cloud WAF, Fastly Next-Gen WAF, Imperva Web Application Firewall

Cloudflare

Four alternatives

AWS WAF, BunkerWeb, Sucuri WAF, open-appsec

Cloudflare, Fastly

Four alternatives

AWS WAF, Azure WAF, Indusface AppTrana, Prophaze

against: AWS WAF, ModSecurity

Perplexity SonarCloudflare WAF

Three alternatives

AWS WAF, Azure WAF, Barracuda Web Application Firewall

against: Akamai, ImpervaCloudflareChanged

Four alternatives

Barracuda WAF, Cequence Security, DataDome, FortiWeb / FortiWeb Cloud

against: ImpervaCloudflare

Seven alternatives

AWS WAF, Akamai, Barracuda WAF, F5, Fortinet FortiWeb, Imperva, Microsoft Azure WAF

Cloudflare WAF

Two alternatives

BunkerWeb, Sucuri

no first choicenothing named

Grok 4.1 FastCloudflare WAF

One alternative

Barracuda WAF

against: Imperva WAFCloudflareChanged

Four alternatives

AWS WAF + Bot Control, Barracuda WAF, F5 Distributed Cloud, Imperva Cloud WAF

Cloudflare WAF

Three alternatives

AWS WAF, Akamai App & API Protector, Imperva

Cloudflare WAF

Four alternatives

AWS WAF, ModSecurity, Sucuri, Wordfence

Cloudflare

Two alternatives

AWS WAF, Imperva

against: AWS WAF, Azure WAF, Check Point CloudGuard, Cloudflare WAF, Fastly WAF, Google Cloud Armor, Imperva WAF, ModSecurity, Shadow Daemon, Veles

Mistral SmallCloudflare

One alternative

Barracuda WAF

against: Fastly WAFCloudflareHeld

Two alternatives

Barracuda, Reblaze

Cloudflare Web Application Firewall

Eight alternatives

Akamai App & API Protector, Barracuda Web Application Firewall, Fastly Next-Gen WAF, Fortinet FortiWeb, Imperva Web Application Firewall, Microsoft Azure Application Gateway, Wallarm WAF, open-appsec / CloudGuard WAF

Cloudflare WAF, Sucuri Firewall

One alternative

open-appsec

no first choiceagainst: Artofdefence Hyperguard Web Application Firewall, phion airlock Web Application Firewall, radware AppWall Web Application Firewall

DeepSeek V4 FlashCloudflare WAF

Two alternatives

AWS WAF, Barracuda

against: Akamai, ImpervaCloudflareChanged

One alternative

AWS WAF

against: ImpervaAkamai App & API Protector, Cloudflare WAF, Imperva WAF

Four alternatives

AWS WAF, F5 BIG-IP Advanced WAF / NGINX App Protect, Fortinet FortiWeb, Radware Cloud WAF / Alteon

Cloudflare

Five alternatives

ModSecurity, OWASP Core Rule Set, SafeLine, Sucuri, open-appsec

no first choiceagainst: Akamai, Barracuda, Cloudflare WAF, Fastly, Imperva, Microsoft Azure WAF, ModSecurity

Llama 4 MaverickCloudflare

Two alternatives

Barracuda, Fastly WAF

CloudflareHeldno first choiceCloudflare WAF

Two alternatives

ModSecurity with OWASP Core Rule Set, Sucuri

no first choiceagainst: Artofdefence Hyperguard Web Application Firewall, phion airlock Web Application Firewall, radware AppWall Web Application Firewall

Qwen 3.7 FlashCloudflare

Two alternatives

AWS WAF, Imperva

against: F5 BIG-IPCloudflareHeld

Four alternatives

AWS WAF, Amazon Shield, Azure Front Door, F5 Advanced WAF

Cloudflare WAF

Four alternatives

AWS WAF, Akamai App & API Protector, F5 Advanced WAF, Imperva

against: ModSecurityCloudflare

Three alternatives

Coraza WAF, ModSecurity, StackPath

no first choiceagainst: AWS WAF, Azure Firewall WAF, Barracuda, Cisco, Google Cloud Armor, ModSecurity, Netscreen, OWASP Core Rule Set

Kimi K2Cloudflare WAF

One alternative

Barracuda WAF/WAAP

against: ImpervaCloudflareChanged

Five alternatives

AWS WAF + Bot Control, Barracuda WAF-as-a-Service, DataDome, HUMAN Security, Imperva Cloud WAF

against: Akamai, F5 BIG-IPCloudflare WAF

Five alternatives

AWS WAF, Akamai App & API Protector, F5 BIG-IP / NGINX App Protect, Fastly Next-Gen WAF, Imperva Cloud WAF / Gateway

against: ModSecurityCloudflare

Three alternatives

Coraza, ModSecurity, Sucuri

AWS WAF, Cloudflare

Three alternatives

Akamai, Fastly, Imperva

against: AWS WAF, Azure WAF, Cloudflare WAF, Google Cloud Armor, ModSecurity, Radware Cloud WAF

GLM 4.7 FlashXCloudflare WAF

Three alternatives

AWS WAF, Barracuda, F5 BIG-IP

against: Akamai, Imperva, SucuriCloudflareChanged

Three alternatives

Akamai, Barracuda, Imperva

no first choiceCloudflare

Three alternatives

BunkerWeb, ModSecurity + OWASP CRS, Sucuri Basic Platform

against: Impervano first choiceagainst: Barracuda, ModSecurity

MiniMax M2.5Cloudflare WAF

Three alternatives

AWS WAF, Barracuda, Imperva WAF

CloudflareChanged

Three alternatives

AWS WAF + Bot Control, Barracuda, Imperva

Cloudflare WAF

Five alternatives

AWS WAF, F5 BIG-IP Advanced WAF, Imperva Cloud WAF, Microsoft Azure WAF, Radware Cloud WAF

Cloudflare

One alternative

Sucuri

against: Akamai, ImpervaCloudflare

Two alternatives

Barracuda, Imperva

against: F5against: Coraza, ModSecurity

Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record

Seventy-two rows: every prompt, every model, every answer.

Prompt	Model	Version string	Time (UTC)	Searched	Sources	Latency
Direct recommendation	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 12:48	no	0	5 s
Direct recommendation	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 10:34	yes	4	9 s
Direct recommendation	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 11:37	yes	12	27 s
Direct recommendation	Perplexity Sonar	`sonar`	2026-09-17 12:18	yes	20	5 s
Direct recommendation	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 11:39	yes	44	20 s
Direct recommendation	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 13:15	yes	5	4 s
Direct recommendation	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 11:12	yes	18	19 s
Direct recommendation	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 10:51	yes	5	2 s
Direct recommendation	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 11:24	yes	9	35 s
Direct recommendation	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 12:35	yes	9	22 s
Direct recommendation	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 10:15	yes	12	103 s
Direct recommendation	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 12:25	yes	9	25 s
Paraphrase	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 12:27	yes	16	9 s
Paraphrase	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 14:01	yes	5	8 s
Paraphrase	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 10:24	yes	15	28 s
Paraphrase	Perplexity Sonar	`sonar`	2026-09-17 11:39	yes	20	5 s
Paraphrase	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 09:35	yes	16	9 s
Paraphrase	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 12:00	yes	5	4 s
Paraphrase	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 11:29	yes	10	14 s
Paraphrase	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 12:25	yes	9	4 s
Paraphrase	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 11:35	no	0	47 s
Paraphrase	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 11:59	yes	10	62 s
Paraphrase	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 10:31	yes	18	80 s
Paraphrase	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 13:13	yes	5	37 s
Comparative	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 09:44	yes	9	9 s
Comparative	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 12:51	yes	5	8 s
Comparative	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 11:16	yes	20	27 s
Comparative	Perplexity Sonar	`sonar`	2026-09-17 14:09	yes	20	9 s
Comparative	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 10:21	yes	26	15 s
Comparative	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 10:20	yes	9	11 s
Comparative	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via deepinfra`	2026-09-17 13:40	yes	28	79 s
Comparative	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 14:08	yes	5	2 s
Comparative	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 09:55	no	0	39 s
Comparative	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 10:11	yes	10	50 s
Comparative	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 12:13	no	0	139 s
Comparative	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 14:15	yes	5	18 s
Budget constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 12:34	yes	9	8 s
Budget constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 09:23	yes	4	6 s
Budget constrained	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 10:44	yes	12	19 s
Budget constrained	Perplexity Sonar	`sonar`	2026-09-17 12:05	yes	20	5 s
Budget constrained	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 11:50	yes	17	9 s
Budget constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 11:47	yes	5	4 s
Budget constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 09:58	yes	10	14 s
Budget constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 12:41	yes	5	2 s
Budget constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 10:13	no	0	35 s
Budget constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 11:56	yes	10	20 s
Budget constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 14:09	yes	27	59 s
Budget constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 12:45	yes	5	17 s
Scale constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 13:59	no	0	6 s
Scale constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 10:47	no	0	13 s
Scale constrained	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 13:49	yes	11	24 s
Scale constrained	Perplexity Sonar	`sonar`	2026-09-17 11:12	yes	20	7 s
Scale constrained	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 13:18	yes	17	15 s
Scale constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 11:33	no	0	7 s
Scale constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 09:56	yes	18	23 s
Scale constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 11:02	yes	5	4 s
Scale constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 11:38	no	0	38 s
Scale constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 10:12	yes	9	23 s
Scale constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 11:00	yes	14	114 s
Scale constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 11:18	yes	5	26 s
Negative framing	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 13:54	yes	17	8 s
Negative framing	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 11:54	yes	4	4 s
Negative framing	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 12:38	yes	24	21 s
Negative framing	Perplexity Sonar	`sonar`	2026-09-17 12:45	yes	20	6 s
Negative framing	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 10:08	yes	42	16 s
Negative framing	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 12:43	yes	5	6 s
Negative framing	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 11:51	yes	27	44 s
Negative framing	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 13:49	yes	8	5 s
Negative framing	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 12:42	no	0	41 s
Negative framing	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 11:59	yes	26	34 s
Negative framing	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 12:24	yes	24	61 s
Negative framing	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 11:44	yes	10	20 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings

None. Every name in this category resolved on its own.

Unresolved, counted raw

Amazon Shield

Azure Firewall WAF

Barracuda WAF-as-a-Service

Barracuda WAF/WAAP

Cequence Security

Cloudflare WAF + Cloudflare Bot Management

DenyAll

F5 Advanced WAF & Distributed Cloud WAF

F5 BIG-IP / NGINX App Protect

F5 BIG-IP Advanced WAF / NGINX App Protect

FortiWeb / FortiWeb Cloud

Fortinet FortiWAF

Google Cloud WAF

HUMAN Technologies

Imperva Cloud WAF / Gateway

Imperva WAF / Application Security

Microsoft Azure Application Gateway (WAF)

ModSecurity with OWASP Core Rule Set

Netscreen

Palo Alto Networks Prisma Cloud WAF

Radware Cloud WAF / Alteon

Reblaze

Shadow Daemon

Sucuri Basic Platform

Sucuri Firewall

Veles

Wallarm WAF

Discontinued, still offered

No shut-down product was recommended here.

Web application firewalls

By buyer segment

01The standing

Recommended versus criticized

02What they warned about

03What they cite

Sites the answers cite

Pages the answers cite

04How they answered

05The record

Normalization in this category

Also in network and edge