Web application firewalls for small business buyers
Asked as “web application firewall”, and as “WAF and bot protection service”, on behalf of a small B2B company. 57 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
79%
Clear leader
79Cloudflare WAF11Sucuri WAF02AWS WAF09others
79% of first choices, clear leader.
Since September 2026▼−11Since September 2026: 93% → 83%, −11 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Cloudflare WAF held the lead, −11 points on 93%, inside the 11-point floor.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Cloudflare WAF79%Clear leader▼−11Since September 2026: 93% → 83%, −11 points. Inside the 11-point floor: within noise. Read over the models both editions asked.This pageMid-marketCloudflare WAF69%Clear leader▼−21Since September 2026: 89% → 67%, −21 points. Past the 11-point floor: movement. Read over the models both editions asked.Standing →EnterpriseCloudflare WAF59%Clear leader▲+3Since September 2026: 53% → 57%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →
Cloudflare WAF79%Clear leader▼−11Since September 2026: 93% → 83%, −11 points. Inside the 11-point floor: within noise. Read over the models both editions asked.This pageMid-marketCloudflare WAF69%Clear leader▼−21Since September 2026: 89% → 67%, −21 points. Past the 11-point floor: movement. Read over the models both editions asked.Standing →EnterpriseCloudflare WAF59%Clear leader▲+3Since September 2026: 53% → 57%, +3 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a small B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince September 2026
01Cloudflare WAF79%4%75endorsed leader▼−11Since September 2026: 93% → 83%, −11 points. Inside the 11-point floor: within noise. Read over the models both editions asked.93% → 83%
Cloudflare WAF79%4%75endorsed leader▼−11Since September 2026: 93% → 83%, −11 points. Inside the 11-point floor: within noise. Read over the models both editions asked.93% → 83%02
Sucuri WAF11%0%39accepted challenger▲+6Since September 2026: 4% → 11%, +6 points. Inside the 11-point floor: within noise. Read over the models both editions asked.4% → 11%
Sucuri WAF11%0%39accepted challenger▲+6Since September 2026: 4% → 11%, +6 points. Inside the 11-point floor: within noise. Read over the models both editions asked.4% → 11%03
AWS WAF2%21%56accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
AWS WAF2%21%56accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%04
Indusface AppTrana2%0%10accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%
Indusface AppTrana2%0%10accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%05
Akamai App & API Protector2%50%18criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Akamai App & API Protector2%50%18criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%06
Imperva Cloud WAF2%64%28criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Imperva Cloud WAF2%64%28criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%Show the three products at 0%, ordered by negative rate
09
ModSecurity0%68%19criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
ModSecurity0%68%19criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%08
Fastly Next-Gen WAF0%36%11criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Fastly Next-Gen WAF0%36%11criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%07
Azure WAF0%20%15accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Azure WAF0%20%15accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one is noise, and both are shown. Movement is read over the twelve models both editions asked; GPT-6 Luna, Muse Glimmer 30B joined this edition and are in the standing but not yet in the comparison. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Head to head
All six head-to-head pages: the top four products, each against each
One product takes 79% of first choices here, so the chart would put eight markers in one corner and one at the far edge. The two measurements it plots are columns in the standing above: share, and the negative label rate. Four products carry a negative rate above 25% in this category.
What they warned about
Eleven of fourteen models held their first choice under the paraphrase. Perplexity Sonar, Mistral Small and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
ModSecurity68%
13 of 19 labels negative · 10 of 14 models · 4 hard negative
“Why to avoid: While it's free and widely deployed, ModSecurity requires significant security expertise to configure, tune, and maintain.” DeepSeek V4 Flash, negative prompt
Akamai App & API Protector50%
9 of 18 labels negative · 9 of 14 models · 6 hard negative
“Imperva (for very large enterprises) and Akamai ... high costs and steep learning curves, making them impractical for small businesses” Mistral Small, negative prompt
Imperva Cloud WAF64%
18 of 28 labels negative · 9 of 14 models · 6 hard negative
“Solutions like Imperva (for very large enterprises) and Akamai are powerful but are designed for high-traffic, complex environments... making them impractical for small businesses” Mistral Small, negative prompt
AWS WAF21%
12 of 56 labels negative · 9 of 14 models · 3 hard negative
“The pay-as-you-go model lacks affordability for small clients... rule structure is very complicated and very hard to maintain” Claude Haiku 4.5, negative prompt
What they cite
Citations exist only for the models that return a source list: fourteen of the fourteen in this edition, and all six flagship models on the expanded tier.
Sites the answers cite
73 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 961 links across 189 sites, every framing counted. Ranked by the number of answers carrying the site or page. 10 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
39 answers · 41 citations · 10 models
36 answers · 36 citations · 9 models
vendor site · Radware33 answers · 62 citations · 11 models
31 answers · 40 citations · 10 models
vendor site · CyberPress30 answers · 32 citations · 11 models
28 answers · 58 citations · 10 models
vendor site · Indusface28 answers · 39 citations · 9 models
vendor site · G224 answers · 33 citations · 10 models
vendor site · open-appsec23 answers · 30 citations · 10 models
22 answers · 22 citations · 9 models
vendor site · Cloudflare16 answers · 28 citations · 8 models
vendor site · Amazon16 answers · 20 citations · 11 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
39 answers · 10 models
36 answers · 9 models
30 answers · 11 models
22 answers · 9 models
21 answers · 10 models
21 answers · 9 models
18 answers · 8 models
18 answers · 9 models
16 answers · 7 models
16 answers · 8 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best web application firewall”, “web application firewall”, “web application firewalls”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|
| Cloudflare parent site Cloudflare WAF 79%, Cloudflare Application Security 2% | 81% | 178 | 550,000 | 10,897 | |||
| Sucuri WAF sucuri.net | 11% | 52 | 70 | 1 | 87,613 | 15 | |
| AWS parent site AWS WAF 2%, AWS WAF with Bot Control 0% | 2% | 152 | 368,000 | 114,001 | |||
| Indusface AppTrana indusface.com | 2% | 81 | 10 | 0 | 15,007 | 0 | 8 |
| Barracuda parent site Barracuda WAF 2% | 2% | 10 | 201,000 | 10,561 | |||
| Akamai parent site Akamai App & API Protector 2% | 2% | 87 | 27,100 | 1,614 | |||
| Imperva Cloud WAF imperva.com | 2% | 114 | 90 | 2 | 417,309 | ||
| Azure parent site Azure WAF 0% | 0% | 44 | 301,000 | 47,904 | |||
| Wordfence | 0% | ||||||
| CrowdSec crowdsec.net | 0% | 16 |
Google's top ten for the three searches hold 24 sites; 4 of them are among the sites the models cited here (aws.amazon.com, cloudflare.com, indusface.com, openappsec.io). The first result for “best web application firewall” is gartner.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best web application firewall for a small B2B company?”Paraphrase“Which WAF and bot protection service would you recommend to a small business that sells to other businesses?”Comparative“What are the top web application firewalls for a small team and how do they differ?”Budget-constrained“What is the best web application firewall for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a web application firewall. What should we look at?”Negative“Which web application firewalls should a small business avoid or be cautious about?”
Claude Haiku 4.5Cloudflare WAFCloudflare WAFHeldCloudflare WAFagainst: ModSecurityCloudflare WAF, Sucuri WAFno first choiceagainst: AWS WAF, Akamai App & API Protector, Cloudflare WAF, Fastly Next-Gen WAF, Imperva Cloud WAF
Four alternatives
Azure WAF, Barracuda Web Application Firewall, Prophaze, Sucuri WAFTwo alternatives
AWS WAF with Bot Control, Sucuri WAFThree alternatives
AWS WAF, SonicWall WAF, Sucuri WAFOne alternative
Azure WAFGPT-5.4 miniCloudflare WAFagainst: Barracuda Web Application Firewall, Imperva Cloud WAFCloudflare WAFHeldCloudflare WAFCloudflare WAFagainst: AWS WAFno first choicenothing named
One alternative
AWS WAFOne alternative
AWS WAF + Bot ControlThree alternatives
AWS WAF, Azure WAF, Google Cloud ArmorTwo alternatives
ModSecurity, OWASP Core Rule SetGemini 3.5 FlashCloudflare WAFagainst: AWS WAF, Azure WAF, Google Cloud ArmorCloudflare WAFHeldagainst: DataDomeCloudflare WAFCloudflare WAFagainst: AWS WAF, Azure WAFCloudflare WAFagainst: Fastly Next-Gen WAFagainst: AWS WAF, Akamai App & API Protector, Azure WAF, Coraza, F5 BIG-IP, Fastly Next-Gen WAF, Google Cloud Armor, Imperva SecureSphere, ModSecurity, OWASP Core Rule Set, Radware AppWall, Radware Cloud WAF
Three alternatives
Fastly Next-Gen WAF, Indusface AppTrana, Sucuri WAFTwo alternatives
AWS WAF, CrowdSecThree alternatives
AWS WAF, Indusface AppTrana, Sucuri WAFFour alternatives
BunkerWeb, CrowdSec, SafeLine WAF, Sucuri WAFFour alternatives
AWS WAF, Azure WAF, Sucuri WAF, WordfencePerplexity SonarBarracuda WAF, Cloudflare WAFagainst: Fortinet FortiWeb, Imperva Cloud WAFCloudflare WAFChangedCloudflare WAFagainst: AWS WAF, Sophos Web Application FirewallCloudflare Application Security, Cloudflare WAFagainst: ModSecurityno first choicenothing named
Two alternatives
AWS WAF with Bot Control, Barracuda Web Application FirewallTwo alternatives
Barracuda WAF, Microsoft Azure WAFThree alternatives
AWS WAF, Azure WAF, Sucuri WAFGrok 4.1 FastCloudflare WAFagainst: Imperva Cloud WAFCloudflare WAFHeldagainst: AWS WAF, Imperva Cloud WAFCloudflare WAFagainst: Imperva Cloud WAF, Radware Cloud WAFCloudflare WAFagainst: ModSecurityCloudflare WAFagainst: Akamai App & API Protector, Check Point CloudGuard WAF, Citrix NetScaler, Dell SonicWall, F5 BIG-IP, Fortinet WAF, Imperva Cloud WAF, Radware Cloud WAF
Three alternatives
AWS WAF, Azure WAF, Sucuri WAFOne alternative
Indusface AppTranaTwo alternatives
AWS WAF, Sucuri WAFTwo alternatives
AWS WAF, Sucuri WAFFive alternatives
AWS WAF, Azure WAF, Fastly Next-Gen WAF, Imperva Cloud WAF, Sucuri WAFMistral SmallCloudflare WAF, Sucuri WAFCloudflare WAFChangedagainst: Akamai Bot Manager, Radware Cloud WAFCloudflare WAFCloudflare WAFCloudflare WAFagainst: F5 BIG-IP ASM, Fortinet FortiWebagainst: Akamai App & API Protector, Imperva Cloud WAF
Two alternatives
Google Cloud Armor, open-appsecThree alternatives
AWS WAF, Indusface AppTrana, Sucuri WAFOne alternative
Sucuri WAFThree alternatives
AWS WAF, Akamai App & API Protector, Fastly Next-Gen WAFDeepSeek V4 FlashCloudflare WAFagainst: AWS WAFCloudflare WAFHeldagainst: AWS WAF + Bot Control, Akamai App & API Protector, Imperva Cloud WAF, Radware Cloud WAFCloudflare WAFagainst: Barracuda WAF, Imperva Cloud WAF, ModSecurityCloudflare WAFagainst: ModSecurity, OWASP Core Rule SetCloudflare WAF, Sucuri WAFagainst: AWS WAFagainst: Akamai Kona Site Defender, Barracuda Web Application Firewall, F5 BIG-IP, Imperva Cloud WAF, Microsoft Azure WAF, ModSecurity
One alternative
Sucuri WAFOne alternative
Sucuri WAFThree alternatives
AWS WAF, SafeLine WAF, Sucuri WAFTwo alternatives
SafeLine WAF, Sucuri WAFTwo alternatives
Imperva Cloud WAF, Indusface AppTranaLlama 4 Maverickno first choiceno first choiceHeldCloudflare WAFSucuri WAFno first choiceagainst: Dell SonicWall SRA 4600
One alternative
Sophos Web Application FirewallQwen 3.7 FlashCloudflare WAFCloudflare WAFHeldagainst: Imperva Cloud WAFCloudflare WAFagainst: Akamai App & API Protector, F5 BIG-IP Advanced WAF, Imperva Cloud WAF, ModSecurityCloudflare WAFagainst: Imperva Cloud WAFno first choiceagainst: Check Point, Cisco FTA, F5 BIG-IP, FortiWeb, ModSecurity
One alternative
AWS WAFOne alternative
AWS WAFTwo alternatives
AWS WAF, Google Cloud ArmorThree alternatives
AWS WAF, Imunify360, ModSecurityKimi K2Cloudflare WAFCloudflare WAFHeldagainst: DataDome, HUMAN Security, PerimeterXCloudflare WAFCloudflare WAFCloudflare WAF, Indusface AppTranaagainst: AWS WAF, Cloudflare WAF, ModSecurity
Two alternatives
AWS WAF, Sucuri WAFOne alternative
AWS WAFFour alternatives
AWS WAF, CrowdSec, ModSecurity + OWASP CRS, Sucuri WAFThree alternatives
AWS WAF, ModSecurity, open-appsecThree alternatives
AWS WAF, Azure WAF, Sucuri WAFGLM 4.7 FlashXCloudflare WAFCloudflare WAFHeldagainst: F5 BIG-IP, Imperva Cloud WAFCloudflare WAFagainst: Imperva Cloud WAF, ModSecurityCloudflare WAFno first choiceagainst: Akamai App & API Protector, F5 BIG-IP Advanced WAF, Imperva Cloud WAFnothing named
Four alternatives
AWS WAF, F5 Essential App Protect, Imperva Cloud WAF, Sucuri WAFOne alternative
AWS WAFTwo alternatives
AWS WAF, Sucuri WAFFour alternatives
AWS WAF, Bunny Shield, Sucuri WAF, WordfenceFour alternatives
AWS WAF, Azure WAF, Cloudflare WAF, Sucuri WAFMiniMax M2.5Cloudflare WAFCloudflare WAFHeldCloudflare WAFCloudflare WAF, Sucuri WAFno first choiceagainst: AWS WAF, Akamai App & API Protector, F5 BIG-IP ASM, Imperva Cloud WAF, Raw ModSecurity
Three alternatives
Azure WAF, F5 Essential App Protect, Sucuri WAFFour alternatives
AWS WAF, Fastly Next-Gen WAF, Imperva Cloud WAF, Sucuri Website Security PlatformFour alternatives
AWS WAF, Imperva Cloud WAF, Sucuri WAF, WallarmGPT-6 LunaCloudflare WAFCloudflare WAFHeldCloudflare WAFagainst: Fastly Next-Gen WAFCloudflare WAFno first choiceagainst: AWS WAF, Azure Application Gateway, Azure Application Gateway WAF v2, Cloudflare WAF, ModSecurity, NGINX
One alternative
AWS WAFOne alternative
AWS WAFTwo alternatives
AWS WAF, Vercel WAFTwo alternatives
AWS WAF, FreeMuse Glimmer 30BCloudflare WAF, Sucuri WAFCloudflare WAFChangedCloudflare WAFCloudflare WAFAWS WAF, Akamai App & API Protector, Cloudflare WAF, Imperva Cloud WAFagainst: Akamai App & API Protector, Barracuda WAF appliance, Citrix NetScaler MPX WAF, Dell SonicWall WAF, F5 BIG-IP ASM, F5 NGINX App Protect, Imperva SecureSphere, ModSecurity
One alternative
AWS WAFTwo alternatives
AWS WAF, Sucuri WAFFour alternatives
AWS WAF, ModSecurity, OWASP Core Rule Set, Sucuri WAFThree alternatives
ModSecurity, OWASP Core Rule Set, Sucuri WAFBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 11:42 | yes | 9 | 7 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 13:20 | yes | 3 | 4 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 08:37 | yes | 16 | 22 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-10-01 11:51 | yes | 16 | 4 s |
| Direct recommendation | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 08:34 | yes | 17 | 5 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 12:01 | yes | 10 | 6 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 10:14 | yes | 21 | 22 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 08:49 | yes | 5 | 1 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 12:06 | no | 0 | 25 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 09:19 | yes | 14 | 16 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 10:04 | yes | 13 | 22 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 11:57 | yes | 13 | 31 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-10-01 09:25 | yes | 2 | 11 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 08:00 | yes | 12 | 21 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 09:25 | yes | 17 | 9 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 08:25 | yes | 4 | 5 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 11:11 | no | 0 | 14 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-10-01 12:16 | yes | 28 | 4 s |
| Paraphrase | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 12:13 | yes | 22 | 6 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 11:09 | yes | 5 | 3 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 09:27 | yes | 25 | 26 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 11:08 | yes | 5 | 1 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 10:29 | yes | 15 | 66 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 08:55 | yes | 20 | 28 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 08:14 | yes | 20 | 31 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 10:24 | no | 0 | 61 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-10-01 10:47 | yes | 3 | 12 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 09:23 | yes | 13 | 27 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 08:44 | yes | 19 | 11 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 11:20 | yes | 4 | 9 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 12:53 | yes | 18 | 27 s |
| Comparative | Perplexity Sonar | sonar | 2026-10-01 08:13 | yes | 17 | 5 s |
| Comparative | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 13:19 | yes | 18 | 8 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 11:17 | yes | 11 | 10 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 11:31 | yes | 22 | 42 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 10:04 | yes | 5 | 2 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 13:29 | no | 0 | 28 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 11:43 | yes | 13 | 23 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 10:37 | yes | 16 | 52 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 11:30 | yes | 17 | 35 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-10-01 08:35 | yes | 8 | 24 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 12:34 | yes | 14 | 27 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 09:31 | yes | 10 | 6 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 10:49 | yes | 5 | 5 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 13:01 | yes | 7 | 21 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-10-01 11:43 | yes | 19 | 2 s |
| Budget constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 12:30 | yes | 24 | 6 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 12:05 | yes | 5 | 2 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 11:21 | yes | 24 | 29 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 12:18 | yes | 5 | 1 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 09:16 | no | 0 | 35 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 09:01 | yes | 14 | 24 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 10:51 | yes | 10 | 25 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 12:13 | yes | 5 | 14 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 12:29 | yes | 4 | 17 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 08:26 | yes | 14 | 26 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 08:55 | no | 0 | 6 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 12:50 | no | 0 | 12 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 11:12 | no | 0 | 15 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-10-01 11:14 | yes | 20 | 6 s |
| Scale constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 13:48 | yes | 14 | 7 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 13:42 | no | 0 | 9 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 07:40 | yes | 17 | 33 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 13:24 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 13:09 | no | 0 | 26 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 12:33 | yes | 24 | 31 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 10:33 | yes | 10 | 43 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 10:11 | yes | 5 | 32 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 07:47 | yes | 3 | 22 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 10:38 | yes | 15 | 33 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 08:15 | yes | 19 | 10 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 09:15 | yes | 4 | 5 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 09:25 | yes | 12 | 31 s |
| Negative framing | Perplexity Sonar | sonar | 2026-10-01 08:29 | yes | 19 | 3 s |
| Negative framing | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 08:27 | yes | 18 | 6 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 09:10 | yes | 5 | 4 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 07:56 | yes | 25 | 24 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 10:55 | yes | 5 | 2 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 08:40 | no | 0 | 35 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 10:15 | yes | 24 | 28 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 09:52 | yes | 23 | 84 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 08:37 | yes | 16 | 37 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-10-01 11:49 | yes | 5 | 18 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 09:38 | yes | 17 | 32 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Akamai read as Akamai App & API Protector
Barracuda read as Barracuda Web Application Firewall
Check Point WAF read as Check Point CloudGuard WAF
Cloudflare read as Cloudflare WAF
Cloudflare (Business plan) read as Cloudflare WAF
Cloudflare (Pro / Business) read as Cloudflare WAF
Cloudflare (Pro Plan) read as Cloudflare WAF
Cloudflare (Pro or Business Plan) read as Cloudflare WAF
Cloudflare Business read as Cloudflare WAF
Cloudflare Free read as Cloudflare WAF
Cloudflare Pro read as Cloudflare WAF
Cloudflare's WAF read as Cloudflare WAF
F5 read as F5 BIG-IP Advanced WAF
Fastly read as Fastly Next-Gen WAF
Fastly (Fastly Next‑Gen WAF) read as Fastly Next-Gen WAF
Fastly (formerly Signal Sciences) read as Fastly Next-Gen WAF
Fortinet read as Fortinet FortiWeb
Imperva read as Imperva Cloud WAF
Imperva WAF read as Imperva Cloud WAF
Indusface read as Indusface AppTrana
Radware read as Radware Cloud WAF
Sucuri read as Sucuri WAF
Sucuri (Basic/Pro) read as Sucuri WAF
Sucuri (Pro or Business plan) read as Sucuri WAF
Sucuri Website Firewall read as Sucuri WAF
Sucuri Website Security read as Sucuri WAF
open-appsec / CloudGuard read as open-appsec
open-appsec / CloudGuard WAF read as open-appsec
Unresolved, counted raw
AWS Web Application Firewall
Azure Application Gateway WAF v2
Barracuda WAF appliance
Cisco Cloud Web Application and API Protection
Cisco FTA
Cloudflare's Pro/Business plans
Dell SonicWall
Dell SonicWall SRA 4600
Dell SonicWall WAF
Fortinet WAF
Free
Imunify360
Raw ModSecurity
Sucuri Website Security Platform
Vercel WAF
Wordfence's Cloud WAF
Discontinued, still offered
No shut-down product was recommended here.