# ModSecurity vs AWS WAF: which do AI models recommend for WAF, October 2026

IT AI Recommendation Index, October 2026 Edition, Web application firewalls. Zero of fourteen models named ModSecurity first on the direct prompt; one named AWS WAF. Page: https://it-ai-index.com/network/web-application-firewalls/modsecurity-vs-aws-waf/

| | First-choice share | Rank | Negative rate | Labels | Models naming it |
|---|---|---|---|---|---|
| ModSecurity | 8% | #2 of 11 | 54% | 26 | 12 of 14 |
| AWS WAF | 4% | #3 of 11 | 20% | 54 | 14 of 14 |

## The direct prompt, model by model

- Claude Haiku 4.5: aws waf first (first choices: AWS WAF, Cloudflare WAF)
- Gemini 3.5 Flash: neither first, one named (first choices: Cloudflare WAF) (alternatives: AWS WAF, Barracuda WAF-as-a-Service, Fastly Next-Gen WAF)
- Grok 4.1 Fast: neither first, one named (first choices: Cloudflare WAF) (alternatives: AWS WAF, Akamai App & API Protector, Azure Application Gateway WAF, Imperva Cloud WAF, Radware Cloud WAF, Sucuri WAF)
- DeepSeek V4 Flash: neither first, one named (first choices: Cloudflare WAF) (alternatives: AWS WAF, Fastly Next-Gen WAF)
- Qwen 3.7 Flash: neither first, one named (first choices: Cloudflare WAF) (alternatives: AWS WAF, Fastly Next-Gen WAF, Imperva Cloud WAF)
- Kimi K2: neither first, one named (first choices: Cloudflare WAF) (alternatives: AWS WAF, Imperva Cloud WAF)
- GLM 4.7 FlashX: neither first, one named (first choices: Cloudflare WAF) (alternatives: AWS WAF, F5 Advanced WAF, Imperva Cloud WAF)
- GPT-6 Luna: neither first, one named (first choices: Cloudflare WAF) (alternatives: AWS WAF, Azure Front Door Premium with WAF, Fastly Next-Gen WAF)
- GPT-5.4 mini: neither named (first choices: Cloudflare WAF) (alternatives: Imperva Cloud WAF)
- Perplexity Sonar: neither named (first choices: Barracuda WAF) (alternatives: Akamai App & API Protector, Cloudflare WAF, Imperva Cloud WAF)
- Mistral Small: neither named (first choices: Barracuda Web Application Firewall) (alternatives: Cloudflare WAF, Imperva Cloud WAF, Reblaze WAAP)
- Llama 4 Maverick: neither named (first choices: Radware Cloud WAF)
- MiniMax M2.5: neither named (first choices: Barracuda Web Application Firewall, Cloudflare WAF) (alternatives: OpenAppSec / Check Point CloudGuard WAF)
- Muse Glimmer 30B: neither named (first choices: Cloudflare WAF) (alternatives: Barracuda WAF, Sucuri WAF)

## What the models said about ModSecurity

- "ModSecurity, the classic open-source WAF engine, has reached End-of-Life (EOL)." (Gemini 3.5 Flash, budget prompt, hard negative)
- "Avoid/Be cautious with: Unpatched ModSecurity v3 versions" (Kimi K2, negative prompt, hard negative)
- "A critical vulnerability (CVE-2025-47947) in ModSecurity, a widely deployed open-source WAF, allows attackers to crash systems through denial of service attacks" (Claude Haiku 4.5, negative prompt, soft negative)
- "If you want the absolute lowest cost and have internal sysadmin skills: go with ModSecurity (free) + OWASP CRS." (MiniMax M2.5, budget prompt, first choice)
- "best-value WAF is usually an open-source stack: ModSecurity + OWASP Core Rule Set (CRS)" (GPT-5.4 mini, budget prompt, first choice)
- "ModSecurity with OWASP CRS is the de-facto standard free engine." (Muse Glimmer 30B, budget prompt, first choice)

## What the models said about AWS WAF

- "using the provider's native WAF (e.g., AWS WAF) is highly convenient... but may require more manual configuration and rule writing" (Gemini 3.5 Flash, scale prompt, soft negative)
- "AWS WAF, for example, has an 8 KB inspection limit on Application Load Balancers and AppSync; gRPC request bodies aren't inspected" (GPT-6 Luna, negative prompt, soft negative)
- "The WAFFLED results show parsing discrepancies affect AWS, Azure, Cloud Armor, Cloudflare and ModSecurity alike." (Muse Glimmer 30B, negative prompt, soft negative)
- "Cloudflare or AWS WAF usually give the quickest time-to-value, decent out-of-the-box rules, and scalable bot mitigation" (MiniMax M2.5, paraphrase prompt, first choice)
- "I'd suggest starting with either Cloudflare WAF ... or AWS WAF (if you're already AWS-based)" (Claude Haiku 4.5, direct prompt, first choice)
- "Consider managed WAF services (AWS WAF, Azure WAF, Cloudflare) for better maintenance and faster patching" (Kimi K2, negative prompt, alternative)

Share is the count of first choices across the direct, paraphrase, budget and scale prompts over all fourteen models, for a mid-market B2B company; rank is within the category. Comparisons are drawn for the top eight products in each category. Published under CC BY 4.0; the output is the models' output, and nothing here is a recommendation by the index.