# Web application firewalls: what AI models recommend, September 2026

IT AI Recommendation Index, September 2026 Edition. Asked as "web application firewall" and as "WAF and bot protection service", six framings each, to twelve models with search on, on behalf of a mid-market B2B company. Page: https://it-ai-index.com/network/web-application-firewalls/

**Standing:** Cloudflare leads with 55% of first choices; verdict clear leader. 44 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| # | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | Cloudflare | 55% | 0% | 33 |
| 2 | Cloudflare WAF | 34% | 11% | 27 |
| 3 | AWS WAF | 5% | 13% | 38 |
| 4 | Fastly | 2% | 10% | 10 |
| 5 | Barracuda | 0% | 20% | 15 |
| 6 | Akamai | 0% | 27% | 22 |
| 7 | Imperva | 0% | 37% | 27 |
| 8 | ModSecurity | 0% | 56% | 18 |

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: AWS WAF, Cloudflare WAF; alternatives Fortinet FortiWAF
- GPT-5.4 mini: Cloudflare WAF; alternatives AWS WAF, Akamai App & API Protector, F5 Distributed Cloud WAF
- Gemini 3.5 Flash: Cloudflare WAF; alternatives Fastly Next-Gen WAF, Imperva Cloud WAF
- Perplexity Sonar: Cloudflare WAF; alternatives AWS WAF, Azure WAF, Barracuda Web Application Firewall
- Grok 4.1 Fast: Cloudflare WAF; alternatives Barracuda WAF
- Mistral Small: Cloudflare; alternatives Barracuda WAF
- DeepSeek V4 Flash: Cloudflare WAF; alternatives AWS WAF, Barracuda
- Llama 4 Maverick: Cloudflare; alternatives Barracuda, Fastly WAF
- Qwen 3.7 Flash: Cloudflare; alternatives AWS WAF, Imperva
- Kimi K2: Cloudflare WAF; alternatives Barracuda WAF/WAAP
- GLM 4.7 FlashX: Cloudflare WAF; alternatives AWS WAF, Barracuda, F5 BIG-IP
- MiniMax M2.5: Cloudflare WAF; alternatives AWS WAF, Barracuda, Imperva WAF

## Sources the answers cite

62 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- cybersecuritynews.com: 31 answers, 47 citations
- openappsec.io: 31 answers, 46 citations
- cyberpress.org: 30 answers, 30 citations
- wafplanet.com: 26 answers, 45 citations
- expertinsights.com: 25 answers, 25 citations
- imperva.com: 16 answers, 18 citations
- geekflare.com: 15 answers, 16 citations
- radware.com: 13 answers, 25 citations

Pages named in the most answers:

- https://cyberpress.org/waf-solutions-by-business-size (29 answers)
- https://expertinsights.com/network-security/the-top-web-application-firewalls (25 answers)
- https://openappsec.io/post/best-waf-solutions-in-2024-2025-real-world-comparison (23 answers)
- https://cybersecuritynews.com/best-web-application-firewall-solutions (17 answers)
- https://wafplanet.com/ (17 answers)
- https://cybersecuritynews.com/best-web-application-firewall-solutions/amp (15 answers)
- https://geekflare.com/cybersecurity/best-web-application-firewall (15 answers)
- https://openappsec.io/post/best-waf-solutions-in-2026-real-world-comparison (15 answers)
- https://cybersecuritynews.com/best-web-application-firewall-waf (14 answers)
- https://aimultiple.com/waf-solutions (12 answers)

## Warned against

- ModSecurity: 10 of 18 labels negative. "Avoid: Unmanaged Open Source (ModSecurity/CoreRuleSet) ... Do not install this unless you have a dedicated security engineer" (Qwen 3.7 Flash, negative prompt)
- Imperva: 10 of 27 labels negative. "Avoid assuming Imperva's signature protections are sufficient — independent tests show they miss most attacks." (DeepSeek V4 Flash, negative prompt)
- Akamai: 6 of 22 labels negative. "Why Not Akamai or Enterprise F5 for Mid-Market? ... you're paying for capacity you don't need." (Kimi K2, paraphrase prompt)
- AWS WAF: 5 of 38 labels negative. "Out of the box, AWS WAF is essentially a blank canvas... It requires deep cloud-engineering expertise to manage, meaning high operational overhead" (Gemini 3.5 Flash, direct prompt)

## Record

- Method: https://it-ai-index.com/methodology/
- Raw judge labels and full responses: https://it-ai-index.com/data/
- License: CC BY 4.0. Cite as IT AI Recommendation Index, September 2026 Edition, it-ai-index.com.