Index › Network and edge › WAF › Small business › September 2026 Edition

Web application firewalls for small business buyers

Asked as “web application firewall”, and as “WAF and bot protection service”, on behalf of a small B2B company. 44 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.

Standing

Cloudflare

Clear leader

73% of first choices, clear leader.

ShowinginAll 67 categories →

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

Small business

Cloudflare73%Clear leaderThis page Mid-market

Cloudflare55%Clear leaderStanding →Enterprise

Cloudflare27%ContestedStanding →

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a small B2B company. Ordered by share.

ProductFirst-choice shareNegative rateLabelsQuadrant

Cloudflare6%47endorsed leader

Cloudflare WAF0%19accepted challenger

Sucuri5%38accepted challenger

Show the five products at 0%, ordered by negative rate

Akamai70%20criticized challenger

Imperva67%30criticized challenger

ModSecurity60%15criticized challenger

AWS WAF22%41accepted challenger

Azure WAF18%11accepted challenger

Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

Head to head

Cloudflare vs Cloudflare WAF Cloudflare vs AWS WAF Cloudflare WAF vs AWS WAF

One product takes 73% of first choices here, so the chart would put seven markers in one corner and one at the far edge. The two measurements it plots are columns in the standing above: share, and the negative label rate. Three products carry a negative rate above 25% in this category. Jump to the standing

02What they warned about

Five of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, DeepSeek V4 Flash, Kimi K2 and GLM 4.7 FlashX changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.

Imperva

67%

20 of 30 labels negative · 9 of 12 models · 7 hard negative

“Enterprise-Grade Commercial WAFs (Imperva, Akamai, F5 BIG-IP ASM) **Avoid unless you are being acquired by a Fortune 500 company.**” DeepSeek V4 Flash, negative prompt

Akamai

70%

14 of 20 labels negative · 8 of 12 models · 5 hard negative

“A common mistake for small teams is choosing enterprise-grade platforms (Imperva, Akamai, F5)” DeepSeek V4 Flash, comparative prompt

ModSecurity

60%

9 of 15 labels negative · 6 of 12 models · 3 hard negative

“Unmanaged Open-Source WAFs (e.g., Raw ModSecurity)... Why to avoid them: While the software is free, the labor is incredibly expensive.” Gemini 3.5 Flash, negative prompt

AWS WAF

22%

9 of 41 labels negative · 6 of 12 models

“The Catch:** It requires manual configuration, and AWS Bot Control is charged on a usage basis ... which can get expensive and complex to fine-tune” Gemini 3.5 Flash, paraphrase prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

64 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 794 links across 176 sites, every framing counted. Ranked by the number of answers carrying the site or page.

cyberpress.org

48 answers · 49 citations · 10 models

wafplanet.com

36 answers · 90 citations · 10 models

geekflare.com

32 answers · 33 citations · 10 models

openappsec.io

vendor site · open-appsec23 answers · 31 citations · 8 models

comparitech.com

21 answers · 22 citations · 10 models

expertinsights.com

vendor site · Expert Insights20 answers · 20 citations · 10 models

cybersecuritynews.com

19 answers · 24 citations · 10 models

sourceforge.net

vendor site · SourceForge17 answers · 17 citations · 10 models

indusface.com

vendor site · Indusface15 answers · 16 citations · 9 models

imperva.com

vendor site · Imperva12 answers · 13 citations · 8 models

reddit.com

11 answers · 14 citations · 6 models

g2.com

9 answers · 20 citations · 6 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

cyberpress.org/waf-solutions-by-business-size

48 answers · 10 models

geekflare.com/cybersecurity/best-web-application-firewall

30 answers · 9 models

comparitech.com/net-admin/best-web-application-firewall

21 answers · 10 models

expertinsights.com/network-security/the-top-web-application-firewalls

20 answers · 10 models

sourceforge.net/software/web-application-firewalls-waf/for-small-business

17 answers · 10 models

wafplanet.com/

15 answers · 8 models

wafplanet.com/blog/waf-pricing-comparison-2026

14 answers · 8 models

openappsec.io/post/best-waf-solutions-in-2024-2025-real-world-comparison

13 answers · 6 models

wafplanet.com/best-waf-for/small-business

13 answers · 10 models

cybersecuritynews.com/best-web-application-firewall-solutions

11 answers · 8 models

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.

ModelDirect“What is the best web application firewall for a small B2B company?”Paraphrase“Which WAF and bot protection service would you recommend to a small business that sells to other businesses?”Comparative“What are the top web application firewalls for a small team and how do they differ?”Budget-constrained“What is the best web application firewall for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a web application firewall. What should we look at?”Negative“Which web application firewalls should a small business avoid or be cautious about?”

Claude Haiku 4.5Cloudflare WAF

One alternative

AWS WAF

against: Akamai/Shadowbox, ImpervaCloudflareChanged

One alternative

AWS WAF

against: ImpervaCloudflare

Three alternatives

AWS WAF, Fastly Next-Gen WAF, Sucuri

Cloudflare

Two alternatives

ModSecurity, Sucuri

no first choiceagainst: Cloudflare, Fortinet FortiWeb

GPT-5.4 miniCloudflare WAF

Two alternatives

AWS WAF, Azure Web Application Firewall

against: Fastly Next-Gen WAF, Imperva WAFCloudflare WAF + Super Bot Fight ModeChanged

Two alternatives

AWS WAF + Bot Control, Cloudflare Bot Management

Cloudflare WAF

Three alternatives

AWS WAF, Barracuda WAF / WAF-as-a-Service, Fastly Next-Gen WAF

Cloudflareagainst: AWS WAFno first choicenothing named

Gemini 3.5 FlashCloudflare WAF

Four alternatives

AWS WAF, Azure WAF, Fastly Next-Gen WAF, Sucuri Website Security

CloudflareChanged

One alternative

Sucuri

against: AWS WAFCloudflare WAF

Three alternatives

AWS WAF, Fastly Next-Gen WAF, Sucuri Website Security

Cloudflare

Two alternatives

AWS WAF, Sucuri Website Security

against: ModSecurity, OWASP CorazaCloudflare

Two alternatives

AWS WAF, Sucuri Website Security

against: AWS WAF, Akamai App & API Protector, Azure WAF, Barracuda WAF, F5 Advanced WAF, Fortinet FortiWeb, ModSecurity

Perplexity SonarCloudflare WAF, Sucuriagainst: ImpervaCloudflareChanged

Three alternatives

DataDome, Radware Bot Manager, Sucuri

Cloudflare WAF

Three alternatives

AWS WAF, Barracuda WAF, Sucuri

against: Sophos Web Application FirewallCloudflare WAF

Two alternatives

AWS WAF, Sucuri

against: Akamai, Impervano first choiceagainst: Barracuda WAF, Citrix NetScaler MPX WAF, Dell SonicWall WAF, F5 BIG-IP ASM

Grok 4.1 FastCloudflare

Two alternatives

AWS WAF, Sucuri

against: Azure WAF, ImpervaCloudflareHeld

One alternative

AWS WAF

against: Akamai, ImpervaCloudflare

Three alternatives

AWS WAF, Azure WAF, Sucuri

against: ModSecurityCloudflare

Two alternatives

AWS WAF, Sucuri

against: ModSecurityCloudflare

Two alternatives

AWS WAF, Imperva

against: AWS WAF, Akamai App & API Protector, Check Point CloudGuard WAF, F5 BIG-IP ASM, Imperva

Mistral SmallCloudflare

One alternative

Sucuri

CloudflareHeldagainst: Akamai, ImpervaCloudflare WAF, Sucuri

One alternative

Sophos Web Application Firewall

Cloudflare

One alternative

Sucuri

against: Bunny Shieldno first choiceagainst: Dell, F5, Imperva, SonicWall

DeepSeek V4 FlashCloudflare WAF

One alternative

Sucuri

against: AWS WAF, Akamai, ImpervaCloudflareChanged

Three alternatives

AWS WAF + Bot Control, Imperva, Sucuri

Cloudflare WAF

Three alternatives

AWS WAF, Coraza, Sucuri Website Security

against: Akamai, F5, Imperva, ModSecurityCloudflare

Two alternatives

Microsoft Azure WAF, Sucuri

against: ModSecurityCloudflare

Two alternatives

AWS WAF, Sucuri

against: Akamai, F5, Impervaagainst: AWS WAF, Akamai, Barracuda physical appliances, F5 BIG-IP ASM, Fortinet FortiWeb, Imperva, ModSecurity + OWASP CRS, NAXSI

Llama 4 MaverickCloudflare

One alternative

Sucuri

CloudflareHeld

Four alternatives

Akamai App & API Protector, Bunny.net, Identiqa WebShield, Imperva

Cloudflare WAF

Two alternatives

Sophos Web Application Firewall, Sucuri

Cloudflare

One alternative

Sucuri

no first choiceagainst: Cloudflare

Qwen 3.7 FlashCloudflare

Four alternatives

AWS WAF, Amazon CloudFront, Imperva, Sucuri

CloudflareHeld

Two alternatives

AWS Shield, Azure WAF

against: Akamai, ImpervaCloudflare

One alternative

Sucuri

against: AWS WAFCloudflare

Five alternatives

AWS WAF, Azure WAF, ModSecurity, OWASP Core Rule Set, Sucuri

Cloudflare

One alternative

AWS Shield Advanced / Amazon WAF

against: F5 BIG-IP, F5 NGINX, Palo Alto VMsagainst: Akamai, Barracuda, F5 Networks, Imperva, ModSecurity, OWASP Core Rule Set

Kimi K2Cloudflare WAF

Two alternatives

AWS WAF, Sucuri

CloudflareChangedagainst: AWS WAFCloudflare WAF

Three alternatives

AWS WAF, Sucuri WAF, open-appsec

Cloudflare WAF

Four alternatives

BunkerWeb, ModSecurity with OWASP CRS, SamWaf, Sucuri

Cloudflare, Sucuri

One alternative

AWS/Azure WAF

against: F5, Impervaagainst: AWS WAF, Akamai, Barracuda 360, Imperva, ModSecurity

GLM 4.7 FlashXCloudflare WAF

Two alternatives

AWS WAF, Sucuri WAF

against: Akamai, Fastly Next-Gen WAF, ImpervaCloudflareChanged

Two alternatives

Imperva Web Application Firewall, Indusface AppTrana

against: F5 BIG-IP Advanced WAFCloudflare WAF

Four alternatives

AWS WAF, Imperva Cloud WAF, Sophos Firewall (XGS) WAF, Sucuri WAF

against: F5 BIG-IP ASMCloudflare

Five alternatives

BunkerWeb, CacheGuard-OS, ModSecurity, OpenAppSec, Wordfence

against: SucuriCloudflare

Two alternatives

AWS WAF, Imperva

against: Akamaiagainst: Akamai, F5, Imperva, ModSecurity, OWASP Core Rule Set

MiniMax M2.5Cloudflare

Two alternatives

Imperva, Sucuri

CloudflareHeldagainst: Akamai, ImpervaCloudflare WAF

Three alternatives

AWS WAF, Imperva WAF, Sucuri WAF

against: Sophos Web Application FirewallCloudflare

Two alternatives

Azure WAF, Sucuri

no first choiceagainst: F5 BIG-IP, FortiWeb, Imperva WAFagainst: Check Point WAF, Cloudflare, Fastly Web Application Security, Sucuri

Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record

Seventy-two rows: every prompt, every model, every answer.

Prompt	Model	Version string	Time (UTC)	Searched	Sources	Latency
Direct recommendation	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 13:43	no	0	4 s
Direct recommendation	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 14:02	yes	5	6 s
Direct recommendation	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 11:31	yes	10	32 s
Direct recommendation	Perplexity Sonar	`sonar`	2026-09-17 10:11	yes	20	4 s
Direct recommendation	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 13:12	yes	37	18 s
Direct recommendation	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 13:57	yes	5	3 s
Direct recommendation	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 11:54	yes	12	18 s
Direct recommendation	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 13:52	yes	5	3 s
Direct recommendation	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 10:31	no	0	40 s
Direct recommendation	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 12:45	yes	9	21 s
Direct recommendation	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 09:58	yes	14	216 s
Direct recommendation	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 12:22	yes	5	17 s
Paraphrase	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 13:09	no	0	4 s
Paraphrase	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 12:18	yes	5	6 s
Paraphrase	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 12:05	yes	5	19 s
Paraphrase	Perplexity Sonar	`sonar`	2026-09-17 12:28	yes	20	5 s
Paraphrase	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 11:49	yes	13	9 s
Paraphrase	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 14:14	yes	5	4 s
Paraphrase	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 10:47	yes	9	13 s
Paraphrase	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 11:55	yes	5	3 s
Paraphrase	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 12:09	yes	5	33 s
Paraphrase	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 10:33	yes	10	52 s
Paraphrase	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 10:50	yes	15	89 s
Paraphrase	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 09:33	yes	5	39 s
Comparative	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 10:45	yes	17	12 s
Comparative	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 13:17	yes	6	7 s
Comparative	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 12:15	yes	19	24 s
Comparative	Perplexity Sonar	`sonar`	2026-09-17 10:04	yes	20	8 s
Comparative	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 10:55	yes	31	16 s
Comparative	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 13:16	yes	20	14 s
Comparative	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 13:24	yes	17	19 s
Comparative	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 12:43	yes	5	3 s
Comparative	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 13:40	yes	10	42 s
Comparative	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 09:56	yes	14	41 s
Comparative	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 11:40	yes	29	33 s
Comparative	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 13:45	yes	20	70 s
Budget constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 10:12	yes	9	9 s
Budget constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 11:01	yes	3	5 s
Budget constrained	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 14:15	yes	7	18 s
Budget constrained	Perplexity Sonar	`sonar`	2026-09-17 12:06	yes	20	4 s
Budget constrained	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 10:33	yes	28	14 s
Budget constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 11:28	yes	5	4 s
Budget constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 10:24	yes	10	12 s
Budget constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 11:56	yes	5	2 s
Budget constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 09:44	yes	5	21 s
Budget constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 10:43	yes	10	19 s
Budget constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 11:17	yes	8	25 s
Budget constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 11:08	yes	5	18 s
Scale constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 13:47	no	0	7 s
Scale constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 11:38	no	0	7 s
Scale constrained	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 14:04	yes	9	25 s
Scale constrained	Perplexity Sonar	`sonar`	2026-09-17 11:36	yes	20	7 s
Scale constrained	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 11:59	yes	13	9 s
Scale constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 10:55	no	0	8 s
Scale constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 13:00	yes	20	24 s
Scale constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 10:06	yes	5	3 s
Scale constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 13:48	no	0	33 s
Scale constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 11:37	yes	13	26 s
Scale constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 10:30	yes	18	92 s
Scale constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 11:54	no	0	68 s
Negative framing	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 12:55	yes	19	9 s
Negative framing	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 10:12	yes	4	6 s
Negative framing	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 13:11	yes	27	21 s
Negative framing	Perplexity Sonar	`sonar`	2026-09-17 09:31	yes	20	13 s
Negative framing	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 11:03	yes	42	19 s
Negative framing	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 13:42	yes	5	6 s
Negative framing	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 13:42	yes	28	44 s
Negative framing	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 11:28	yes	5	2 s
Negative framing	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 12:13	yes	14	56 s
Negative framing	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 11:41	yes	26	34 s
Negative framing	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 10:31	yes	28	129 s
Negative framing	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 13:42	yes	13	39 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings

None. Every name in this category resolved on its own.

Unresolved, counted raw

AWS Shield Advanced / Amazon WAF

Akamai/Shadowbox

Azure Application Gateway

Barracuda 360

Barracuda WAF / WAF-as-a-Service

Barracuda physical appliances

Bunny Shield

CacheGuard-OS

Check Point CloudGuard WAF

Check Point WAF (formerly CloudGuard WAF)

Citrix NetScaler MPX WAF

Cloudflare Bot Management

Cloudflare WAF + Super Bot Fight Mode

Dell SonicWall WAF

F5 Essential App Protect

F5 Networks

Fastly Web Application Security

FortiWeb

Identiqa WebShield

ModSecurity with OWASP CRS

OpenAppSec (Community Edition)

Palo Alto VMs

Radware Bot Manager

SamWaf

Sophos Firewall (XGS) WAF

WebKnight

Discontinued, still offered

No shut-down product was recommended here.

Web application firewalls for small business buyers

By buyer segment

01The standing

02What they warned about

03What they cite

Sites the answers cite

Pages the answers cite

04How they answered

05The record

Normalization in this category

Also in network and edge