Web application firewalls for enterprise buyers
Asked as “web application firewall”, and as “WAF and bot protection service”, on behalf of an enterprise B2B company. 51 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
59%
Clear leader
59Cloudflare WAF16Akamai App & API Protector08Imperva Cloud WAF18others
59% of first choices, clear leader.
Since September 2026▲+3Since September 2026: 53% → 57%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Cloudflare WAF held the lead, +3 points on 53%, inside the 11-point floor.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Cloudflare WAF79%Clear leader▼−11Since September 2026: 93% → 83%, −11 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →Mid-marketCloudflare WAF69%Clear leader▼−21Since September 2026: 89% → 67%, −21 points. Past the 11-point floor: movement. Read over the models both editions asked.Standing →EnterpriseCloudflare WAF59%Clear leader▲+3Since September 2026: 53% → 57%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.This page
Cloudflare WAF79%Clear leader▼−11Since September 2026: 93% → 83%, −11 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →Mid-marketCloudflare WAF69%Clear leader▼−21Since September 2026: 89% → 67%, −21 points. Past the 11-point floor: movement. Read over the models both editions asked.Standing →EnterpriseCloudflare WAF59%Clear leader▲+3Since September 2026: 53% → 57%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.This pageThe standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince September 2026
01Cloudflare WAF59%3%63endorsed leader▲+3Since September 2026: 53% → 57%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.53% → 57%
Cloudflare WAF59%3%63endorsed leader▲+3Since September 2026: 53% → 57%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.53% → 57%02
Akamai App & API Protector16%8%50accepted challenger▼−9Since September 2026: 22% → 14%, −9 points. Inside the 11-point floor: within noise. Read over the models both editions asked.22% → 14%
Akamai App & API Protector16%8%50accepted challenger▼−9Since September 2026: 22% → 14%, −9 points. Inside the 11-point floor: within noise. Read over the models both editions asked.22% → 14%03
Imperva Cloud WAF8%12%56accepted challenger▲+2Since September 2026: 7% → 9%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.7% → 9%
Imperva Cloud WAF8%12%56accepted challenger▲+2Since September 2026: 7% → 9%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.7% → 9%04
F5 BIG-IP Advanced WAF4%18%28accepted challenger▲+5Since September 2026: 0% → 5%, +5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 5%
F5 BIG-IP Advanced WAF4%18%28accepted challenger▲+5Since September 2026: 0% → 5%, +5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 5%05
Fastly Next-Gen WAF4%14%22accepted challenger▲+2Since September 2026: 2% → 5%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 5%
Fastly Next-Gen WAF4%14%22accepted challenger▲+2Since September 2026: 2% → 5%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 5%06
AWS WAF2%29%49criticized challenger=heldSince September 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 2%
AWS WAF2%29%49criticized challenger=heldSince September 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 2%Show the three products at 0%, ordered by negative rate
09
Azure WAF0%53%17criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Azure WAF0%53%17criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%08
Radware Cloud WAF0%21%14accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Radware Cloud WAF0%21%14accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%07
Fortinet FortiWeb0%14%14accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Fortinet FortiWeb0%14%14accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one is noise, and both are shown. Movement is read over the twelve models both editions asked; GPT-6 Luna, Muse Glimmer 30B joined this edition and are in the standing but not yet in the comparison. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Head to head
All six head-to-head pages: the top four products, each against each
One product takes 59% of first choices here, so the chart would put eight markers in one corner and one at the far edge. The two measurements it plots are columns in the standing above: share, and the negative label rate. Two products carry a negative rate above 25% in this category.
What they warned about
Five of fourteen models held their first choice under the paraphrase. GPT-5.4 mini, Gemini 3.5 Flash, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
AWS WAF29%
14 of 49 labels negative · 9 of 14 models · 2 hard negative
“Avoid usage-based for predictability: AWS WAF/Azure WAF/Fastly charge per Web ACL ... costs explode at scale” Grok 4.1 Fast, budget prompt
Azure WAF53%
9 of 17 labels negative · 8 of 14 models · 2 hard negative
“Avoid usage-based for predictability: AWS WAF/Azure WAF/Fastly charge per Web ACL” Grok 4.1 Fast, budget prompt
ModSecurity88%
7 of 8 labels negative · 6 of 14 models · 6 hard negative
“Be cautious with ... open-source/modular stacks such as ModSecurity and PHPIDS, which academic and grey literature consistently show higher exploitable bypass rates” Muse Glimmer 30B, negative prompt
Imperva Cloud WAF12%
7 of 56 labels negative · 5 of 14 models · 1 hard negative
“Imperva's WAF achieves only 11.97% security effectiveness, missing 88.03% of actual threats” Claude Haiku 4.5, negative prompt
What they cite
Citations exist only for the models that return a source list: fourteen of the fourteen in this edition, and all six flagship models on the expanded tier.
Sites the answers cite
78 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 1157 links across 278 sites, every framing counted. Ranked by the number of answers carrying the site or page. 10 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
vendor site · Radware45 answers · 96 citations · 11 models
vendor site · Imperva42 answers · 62 citations · 14 models
vendor site · open-appsec30 answers · 33 citations · 10 models
29 answers · 37 citations · 11 models
27 answers · 37 citations · 11 models
19 answers · 37 citations · 8 models
vendor site · Fastly18 answers · 22 citations · 10 models
vendor site · Fortinet18 answers · 22 citations · 9 models
vendor site · Guideflow18 answers · 18 citations · 10 models
17 answers · 17 citations · 10 models
vendor site · Check Point16 answers · 19 citations · 9 models
vendor site · Cloudflare15 answers · 28 citations · 6 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
33 answers · 12 models
21 answers · 9 models
20 answers · 10 models
17 answers · 8 models
16 answers · 10 models
15 answers · 6 models
15 answers · 7 models
15 answers · 10 models
13 answers · 9 models
13 answers · 9 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best web application firewall”, “web application firewall”, “web application firewalls”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days |
|---|---|---|---|---|---|---|---|
| Cloudflare parent site Cloudflare WAF 59%, Cloudflare One 2%, Cloudflare Bot Management 0% | 61% | 372 | 550,000 | 10,897 | |||
| Akamai parent site Akamai App & API Protector 16%, Akamai Kona Site Defender 0% | 16% | 87 | 27,100 | 1,614 | |||
| Imperva Cloud WAF imperva.com Imperva Cloud WAF 8%, Imperva Web Application Firewall 4% | 12% | 114 | 90 | 2 | 417,309 | ||
| F5 BIG-IP Advanced WAF f5.com | 4% | 46 | 50 | 0 | 178,423 | $5 | 120 |
| Fastly Next-Gen WAF fastly.com | 4% | 49 | 70 | 0 | 107,961 | $2,460 | 120 |
| AWS parent site AWS WAF 2%, AWS WAF + Bot Control 0% | 2% | 152 | 368,000 | 114,001 | |||
| NetScaler Web Application Firewall netscaler.com | 2% | 1 | |||||
| F5 Advanced WAF | 0% | 40 | 6 | ||||
| Fortinet parent site Fortinet FortiWeb 0% | 0% | 20 | 49,500 | 2,339 | |||
| Radware Cloud WAF radware.com | 0% | 31 | 30 | 0 | 43,076 | $21 | 13 |
Google's top ten for the three searches hold 24 sites; 4 of them are among the sites the models cited here (checkpoint.com, fortinet.com, gartner.com, openappsec.io). The first result for “best web application firewall” is gartner.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best web application firewall for an enterprise B2B company?”Paraphrase“Which WAF and bot protection service would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade web application firewalls and how do they differ?”Budget-constrained“What is the best web application firewall for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating a web application firewall. What should we look at?”Negative“Which web application firewalls should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5no first choiceno first choiceHeldCloudflare WAF, Imperva Cloud WAFCloudflare WAF, NetScaler Web Application Firewallno first choiceagainst: Azure WAF, F5 BIG-IP Advanced WAF, Imperva Cloud WAF
Three alternatives
AWS WAF, Akamai App & API Protector, F5 Advanced WAFOne alternative
Atomic WAFGPT-5.4 miniF5 BIG-IP Advanced WAFCloudflare WAFChangedAkamai App & API Protector / WAAP, Cloudflare WAFCloudflare WAFno first choicenothing named
Three alternatives
Akamai App & API Protector, Cloudflare WAF, Imperva Cloud WAFTwo alternatives
Akamai App & API Protector, Fastly Next-Gen WAFSix alternatives
AWS WAF, F5 Distributed Cloud WAF, Fastly Next-Gen WAF, Fortinet FortiWeb, Imperva Application Security Platform, Imperva Cloud WAFOne alternative
AWS WAF paired with Shield AdvancedGemini 3.5 FlashFastly Next-Gen WAFCloudflare WAFChangedno first choiceCloudflare WAFCloudflare WAFagainst: AWS WAF, Azure WAFagainst: AWS WAF, Azure WAF, Coraza, F5 BIG-IP ASM, Google Cloud Armor, Imperva SecureSphere, ModSecurity
Three alternatives
Akamai App & API Protector, Cloudflare WAF, Imperva Cloud WAAPFour alternatives
Akamai App & API Protector, DataDome, Fastly Next-Gen WAF, HUMAN SecurityFive alternatives
Akamai App & API Protector, Cloudflare WAF, F5 BIG-IP Advanced WAF, Fastly Next-Gen WAF, Imperva Cloud WAFFive alternatives
Amazon CloudFront Flat-Rate Pricing Plans, Cloudflare One, F5 BIG-IP Virtual Edition, Fastly Next-Gen WAF, Fortinet FortiWebTwo alternatives
Akamai App & API Protector, Fastly Next-Gen WAFPerplexity SonarAkamai App & API ProtectorAkamai App & API ProtectorHeldCloudflare WAF, Imperva Cloud WAFCloudflare WAFno first choiceagainst: AWS WAF, Azure WAF
Four alternatives
AWS WAF, Azure WAF, Cloudflare WAF, Imperva Cloud WAFOne alternative
Cloudflare WAFFive alternatives
Akamai App & API Protector, F5 Advanced WAF, Fastly Next-Gen WAF, Fortinet FortiWeb, Radware Cloud WAFFour alternatives
Akamai App & API Protector, Citrix, F5 BIG-IP Advanced WAF, Imperva Cloud WAFGrok 4.1 FastCloudflare WAFagainst: AWS WAFCloudflare WAFHeldagainst: DataDome, HUMANno first choiceCloudflare WAFagainst: AWS WAF, Azure WAF, Fastly Next-Gen WAFCloudflare WAFagainst: AWS WAF, Alibaba Cloud WAF, Barracuda Web Application Firewall, ModSecurity, Radware AppWall
Three alternatives
Akamai App & API Protector, F5 Advanced WAF, Imperva Cloud WAFTwo alternatives
Akamai App & API Protector, Imperva Cloud WAFThree alternatives
Akamai App & API Protector, F5 Advanced WAF, Imperva Cloud WAFTwo alternatives
AWS WAF, Imperva Cloud WAFMistral SmallAkamai App & API Protector, Imperva Web Application Firewallagainst: F5 BIG-IP Advanced WAFCloudflare WAF, Imperva Cloud WAFChangedno first choiceAWS WAF, Cloudflare WAFagainst: F5 BIG-IP Advanced WAF, Imperva Cloud WAF, Radware AppWallno first choiceagainst: Check Point, F5 BIG-IP Advanced WAF, Fortinet FortiWeb, Imperva Cloud WAF, Radware Cloud WAF
One alternative
AWS WAFTwo alternatives
AWS WAF, Cequence SecurityOne alternative
Azure Web Application FirewallDeepSeek V4 FlashCloudflare WAFAkamai App & API ProtectorChangedagainst: AWS WAF, Imperva Cloud WAF, ModSecurityAkamai App & API Protector, Cloudflare WAFCloudflare WAFagainst: AWS WAF, Akamai App & API Protector, Azure WAF, F5 BIG-IP, Imperva Cloud WAFno first choiceagainst: Barracuda appliances, Check Point, Cisco, F5 BIG-IP ASM, Imperva SecureSphere appliances, ModSecurity, Sophos
Four alternatives
Akamai App & API Protector, F5 BIG-IP Advanced WAF, Imperva Cloud WAF, Radware Cloud WAFOne alternative
Cloudflare Bot ManagementFive alternatives
AWS WAF, Check Point CloudGuard WAF, F5 BIG-IP Advanced WAF, Imperva Cloud WAF, Radware Cloud WAFLlama 4 MaverickAkamai App & API Protector, F5 BIG-IP Advanced WAF, Imperva Web Application Firewallno first choiceChangedno first choiceCloudflare WAFno first choicenothing named
One alternative
Azure WAFQwen 3.7 FlashCloudflare WAFagainst: Akamai Application Delivery SecurityCloudflare OneChangedAkamai Adaptive Application Firewall, Cloudflare WAFImperva Cloud WAFagainst: AWS WAF, Azure WAFAkamai App & API Protector, Cloudflare WAF, Fastly Next-Gen WAFagainst: Cisco Firepower, Fortinet FortiWebagainst: AWS Shield, Check Point, F5 BIG-IP Advanced WAF, ModSecurity, Radware Cloud WAF
Three alternatives
F5 BIG-IP Advanced WAF, Imperva Cloud WAF, Imperva SecureSphereTwo alternatives
F5 Advanced WAF, Imperva Cloud WAFFour alternatives
AWS WAF, F5 Advanced WAF, Fortinet FortiWeb, Imperva Cloud WAFTwo alternatives
F5 BIG-IP Advanced WAF, Zscaler Internet AccessTwo alternatives
F5 BIG-IP Advanced WAF, Imperva Cloud WAFKimi K2Cloudflare WAF, Imperva Cloud WAFCloudflare WAFChangedF5 Distributed Cloud WAAP, Imperva Cloud WAFCloudflare WAFagainst: AWS Shield, AWS WAF, Akamai App & API Protector, Azure WAFno first choiceagainst: AWS WAF, F5 BIG-IP, ModSecurity, NAXSI, NGINX ModSecurity WAF
Three alternatives
AWS WAF, F5 BIG-IP Advanced WAF, Fortinet FortiWebTwo alternatives
Akamai App & API Protector, Imperva Cloud WAFThree alternatives
AWS WAF, Cloudflare WAF, Microsoft Azure WAFTwo alternatives
F5 Distributed Cloud, Imperva Cloud WAFGLM 4.7 FlashXImperva Cloud WAFCloudflare WAFChangedCloudflare WAFCloudflare WAFagainst: AWS WAF, Azure WAFno first choiceagainst: Akamai App & API Protector, Barracuda WAF, Cloudflare WAF, Fastly Next-Gen WAF, Imperva Cloud WAF, Radware Cloud WAF
Two alternatives
Cloudflare WAF, F5 BIG-IPOne alternative
Imperva Cloud WAFFour alternatives
AWS WAF, Akamai App & API Protector, F5 BIG-IP Advanced WAF, Imperva Cloud WAFTwo alternatives
F5 BIG-IP Advanced WAF, Imperva Cloud WAFMiniMax M2.5Cloudflare WAFCloudflare WAFHeldno first choiceno first choiceno first choicenothing named
Four alternatives
AWS WAF, Akamai WAF, F5 BIG-IP WAF, Imperva Cloud WAFFive alternatives
AWS WAF, Akamai Kona Site Defender, Azure WAF, F5 Advanced WAF, Imperva Cloud WAFSix alternatives
AWS WAF, Akamai App & API Protector, Cloudflare WAF, F5 BIG-IP Advanced WAF, Imperva Cloud WAF, Radware Cloud WAFGPT-6 LunaCloudflare WAFCloudflare WAFHeldno first choiceCloudflare WAFagainst: AWS WAFno first choiceagainst: AWS WAF Classic, ModSecurity plus OWASP Core Rule Set, The NGINX Plus ModSecurity WAF module
Three alternatives
AWS WAF, Akamai App & API Protector, F5 Distributed Cloud WAAPTwo alternatives
AWS WAF + Bot Control, Akamai App & API Protector + Bot Manager PremierOne alternative
Google Cloud Armor Enterprise AnnualSix alternatives
AWS WAF, Akamai App & API Protector, Azure WAF, Cloudflare WAF, F5 BIG-IP Advanced WAF, Imperva Cloud WAFMuse Glimmer 30BAkamai App & API Protector, Cloudflare WAFAkamai App & API ProtectorChangedAkamai App & API Protector, Imperva Cloud WAFCloudflare WAFagainst: AWS WAFno first choiceagainst: AWS, Akamai App & API Protector, Azure, Barracuda Web Application Firewall, Cloudflare WAF, Fastly Next-Gen WAF, Google Cloud Armor, Imperva Cloud WAF, ModSecurity, OWASP CRS3-rc, PHPIDS
Two alternatives
F5 BIG-IP Advanced WAF, Imperva Cloud WAFTwo alternatives
Cloudflare Bot Management, Imperva Cloud WAFFour alternatives
AWS WAF, Cloudflare WAF, F5 BIG-IP Advanced WAF, Radware Cloud WAFThree alternatives
Akamai Kona Site Defender, F5 BIG-IP, Imperva Cloud WAFBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 07:39 | no | 0 | 4 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 09:50 | yes | 3 | 11 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 07:38 | yes | 17 | 26 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-10-01 09:17 | yes | 17 | 3 s |
| Direct recommendation | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 12:34 | yes | 21 | 8 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 11:34 | yes | 5 | 4 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 09:38 | yes | 20 | 29 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 12:29 | yes | 5 | 2 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 13:29 | yes | 5 | 27 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 08:38 | yes | 18 | 24 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 12:50 | yes | 22 | 69 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 12:13 | yes | 18 | 34 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-10-01 09:34 | yes | 4 | 8 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 07:39 | yes | 23 | 30 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 13:53 | no | 0 | 4 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 12:39 | yes | 5 | 6 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 13:32 | yes | 16 | 28 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-10-01 08:54 | yes | 21 | 3 s |
| Paraphrase | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 11:20 | yes | 24 | 10 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 11:01 | yes | 5 | 5 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 13:47 | yes | 25 | 50 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 10:55 | yes | 5 | 1 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 07:58 | yes | 5 | 50 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 08:10 | yes | 19 | 20 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 10:22 | yes | 25 | 41 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 08:03 | yes | 5 | 76 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-10-01 08:10 | yes | 3 | 16 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 11:37 | yes | 14 | 20 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 11:22 | yes | 16 | 10 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 08:52 | yes | 4 | 10 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 11:29 | yes | 20 | 26 s |
| Comparative | Perplexity Sonar | sonar | 2026-10-01 13:52 | yes | 16 | 21 s |
| Comparative | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 09:22 | yes | 22 | 8 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 12:50 | yes | 11 | 13 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 09:10 | yes | 25 | 37 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 13:04 | yes | 5 | 2 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 11:30 | no | 0 | 37 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 11:35 | yes | 13 | 28 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 10:20 | yes | 23 | 36 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 12:33 | yes | 10 | 18 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-10-01 09:57 | yes | 8 | 27 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 08:58 | yes | 24 | 52 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 10:41 | yes | 9 | 7 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 11:50 | yes | 3 | 4 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 11:27 | yes | 18 | 32 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-10-01 10:56 | yes | 17 | 3 s |
| Budget constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 09:05 | yes | 21 | 8 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 13:50 | yes | 5 | 7 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 10:43 | yes | 21 | 22 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 12:23 | yes | 5 | 1 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 09:14 | yes | 20 | 96 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 08:12 | yes | 24 | 30 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 08:53 | yes | 23 | 102 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 10:23 | yes | 20 | 66 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 13:20 | yes | 3 | 13 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 07:47 | yes | 21 | 39 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 10:31 | yes | 37 | 16 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 10:25 | yes | 2 | 6 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 13:01 | no | 0 | 16 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-10-01 08:04 | yes | 19 | 8 s |
| Scale constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 08:17 | yes | 18 | 8 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 08:28 | no | 0 | 9 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 12:08 | yes | 25 | 62 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 09:27 | yes | 5 | 2 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 08:50 | yes | 5 | 31 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 09:21 | yes | 14 | 23 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 13:04 | yes | 24 | 60 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 10:12 | yes | 15 | 42 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 12:20 | yes | 5 | 24 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 07:58 | yes | 13 | 24 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 11:01 | yes | 19 | 11 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 13:46 | yes | 5 | 6 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 09:07 | yes | 16 | 30 s |
| Negative framing | Perplexity Sonar | sonar | 2026-10-01 09:48 | yes | 18 | 5 s |
| Negative framing | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 07:59 | yes | 25 | 10 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 11:25 | yes | 15 | 11 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 08:12 | yes | 25 | 34 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 08:58 | yes | 5 | 1 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 12:44 | no | 0 | 29 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 07:27 | yes | 24 | 28 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 08:55 | yes | 24 | 45 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 11:01 | yes | 15 | 30 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-10-01 12:19 | yes | 3 | 19 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 08:09 | yes | 24 | 31 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
AWS WAFv2 read as AWS WAF
Akamai read as Akamai App & API Protector
Akamai (App & API Protector + Bot Manager) read as Akamai App & API Protector
Akamai (App & API Protector / Site Defender) read as Akamai App & API Protector
Barracuda read as Barracuda Web Application Firewall
Check Point WAF read as Check Point CloudGuard WAF
Cloudflare read as Cloudflare WAF
Cloudflare Enterprise read as Cloudflare WAF
Cloudflare Enterprise (Externa Packages) read as Cloudflare WAF
Cloudflare Enterprise WAF read as Cloudflare WAF
Cloudflare WAAP (Enterprise Tier) read as Cloudflare WAF
Cloudflare WAF / WAAP read as Cloudflare WAF
F5 read as F5 BIG-IP Advanced WAF
F5 (BIG-IP ASM / NGINX) read as F5 BIG-IP Advanced WAF
F5 (BIG-IP Advanced WAF / Distributed Cloud WAF) read as F5 BIG-IP Advanced WAF
F5 (F5 Advanced WAF / NGINX) read as F5 BIG-IP Advanced WAF
F5 (WAAP) read as F5 BIG-IP Advanced WAF
Fastly read as Fastly Next-Gen WAF
Fastly (Next-Gen WAF) read as Fastly Next-Gen WAF
Fastly (Signal Sciences) read as Fastly Next-Gen WAF
Fortinet read as Fortinet FortiWeb
Imperva read as Imperva Cloud WAF
Imperva (Cloud WAF or WAF Gateway) read as Imperva Cloud WAF
Imperva (Thales) read as Imperva Cloud WAF
Imperva (by Thales) read as Imperva Cloud WAF
Imperva WAF read as Imperva Cloud WAF
Imperva WAF (WAAP) read as Imperva Cloud WAF
Imperva WAF (part of Thales Group) read as Imperva Cloud WAF
Radware read as Radware Cloud WAF
Radware WAF read as Radware Cloud WAF
Sucuri read as Sucuri WAF
open-appsec / CloudGuard WAF read as open-appsec
open-appsec/CloudGuard read as open-appsec
Unresolved, counted raw
AWS WAF Classic
AWS WAF paired with Shield Advanced
Akamai Adaptive Application Firewall
Akamai App & API Protector + Bot Manager Premier
Akamai App & API Protector / WAAP
Akamai App and API Protector
Akamai Application Delivery Security
Alibaba Cloud WAF
Amazon CloudFront Flat-Rate Pricing Plans
Atomic WAF
Azure API Gateway
Barracuda appliances
Barracuda's WAF
Dell's Sonicwall WAF
F5 BIG-IP Virtual Edition
F5 BIG-IP WAF
Google Cloud Armor Enterprise Annual
Imperva Cloud WAAP
Imperva SecureSphere appliances
Imperva’s cloud-based Application Security Platform
ModSecurity plus OWASP Core Rule Set
Myra Security
NGINX App Protect
NGINX ModSecurity WAF
NetScaler Web Application Firewall
OMC Cloud Web Application Firewall
OWASP CRS3-rc
PHPIDS
Radware Cloud Application Protection / WAAP
The NGINX Plus ModSecurity WAF module
Discontinued, still offered
No shut-down product was recommended here.