# Web application firewalls for enterprise buyers: what AI models recommend, September 2026

IT AI Recommendation Index, September 2026 Edition. Asked as "web application firewall" and as "WAF and bot protection service", six framings each, to twelve models with search on, on behalf of an enterprise B2B company. Page: https://it-ai-index.com/network/web-application-firewalls/enterprise/

**Standing:** Cloudflare leads with 27% of first choices; verdict contested. 44 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| # | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | Cloudflare | 27% | 9% | 33 |
| 2 | Akamai App & API Protector | 14% | 4% | 23 |
| 3 | Akamai | 9% | 4% | 27 |
| 4 | Cloudflare WAF | 9% | 7% | 15 |
| 5 | Imperva | 5% | 15% | 33 |
| 6 | AWS WAF | 2% | 33% | 46 |
| 7 | Fastly Next-Gen WAF | 2% | 8% | 12 |
| 8 | F5 | 0% | 15% | 13 |
| 9 | F5 BIG-IP Advanced WAF | 0% | 10% | 10 |
| 10 | Fortinet FortiWeb | 0% | 17% | 12 |
| 11 | Azure WAF | 0% | 40% | 15 |

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: no first choice
- GPT-5.4 mini: Cloudflare WAF/WAAP; alternatives AWS WAF, Azure WAF, F5 Distributed Cloud WAF
- Gemini 3.5 Flash: Cloudflare WAAP, Fastly Next-Gen WAF; alternatives Akamai App & API Protector, F5 Distributed Cloud WAF, Imperva
- Perplexity Sonar: Cloudflare WAF; alternatives AWS WAF, Akamai, Azure WAF, Imperva
- Grok 4.1 Fast: Imperva Cloud WAF; alternatives Akamai App & API Protector, Cloudflare WAF
- Mistral Small: Akamai, Imperva; alternatives Cloudflare
- DeepSeek V4 Flash: Cloudflare; alternatives AWS WAF, Akamai, Azure WAF, Imperva
- Llama 4 Maverick: no first choice
- Qwen 3.7 Flash: Cloudflare; alternatives AWS WAF, Akamai, F5, Imperva
- Kimi K2: Akamai App & API Protector, Cloudflare WAF; alternatives AWS WAF, F5 BIG-IP Advanced WAF, Imperva Cloud WAF
- GLM 4.7 FlashX: Imperva Cloud WAAP; alternatives AWS WAF, Akamai App & API Protector, Cloudflare WAF, F5 BIG-IP Advanced WAF
- MiniMax M2.5: Akamai; alternatives Fastly Next-Gen WAF, Imperva, Open-appsec / CloudGuard, Radware Cloud WAF

## Sources the answers cite

64 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- expertinsights.com: 41 answers, 41 citations
- imperva.com: 35 answers, 44 citations
- cybersecuritynews.com: 34 answers, 53 citations
- wafplanet.com: 30 answers, 46 citations
- openappsec.io: 25 answers, 31 citations
- cyberpress.org: 25 answers, 27 citations
- radware.com: 16 answers, 30 citations
- g2.com: 15 answers, 16 citations

Pages named in the most answers:

- https://expertinsights.com/network-security/the-top-web-application-firewalls (41 answers)
- https://imperva.com/blog/best-waap-solutions (26 answers)
- https://cyberpress.org/waf-solutions-by-business-size (25 answers)
- https://cybersecuritynews.com/best-web-application-firewall-solutions/amp (25 answers)
- https://wafplanet.com/ (21 answers)
- https://cybersecuritynews.com/best-web-application-firewall-waf (19 answers)
- https://openappsec.io/post/best-waf-solutions-in-2024-2025-real-world-comparison (16 answers)
- https://guptadeepak.com/tools/top-5-waf-web-application-firewall-tools-2026 (14 answers)
- https://guideflow.com/blog/web-application-firewall-software (13 answers)
- https://openappsec.io/post/best-waf-solutions-in-2026-real-world-comparison (12 answers)

## Warned against

- AWS WAF: 15 of 46 labels negative. "What to Avoid for Predictable Costs: ... AWS WAF | Usage-based | $0.60 per million requests + per-rule fees; costs spike during attacks" (Kimi K2, budget prompt)
- Imperva: 5 of 33 labels negative. "Independent testing showed only 11.97% true positive rate — missing ~88% of actual threats" (Kimi K2, negative prompt)
- Azure WAF: 6 of 15 labels negative. "You should avoid providers that charge strictly "per request" (like standard AWS WAF or Azure WAF setups)" (Qwen 3.7 Flash, budget prompt)
- GCP Cloud Armor: 4 of 4 labels negative. "GCP Cloud Armor | Usage-based | Per-request pricing creates unpredictable bills" (Kimi K2, budget prompt)

## Record

- Method: https://it-ai-index.com/methodology/
- Raw judge labels and full responses: https://it-ai-index.com/data/
- License: CC BY 4.0. Cite as IT AI Recommendation Index, September 2026 Edition, it-ai-index.com.