Web Security

Detection or Proof: Rethinking the Central Question Behind WAFs

This paper challenges the idea that WAFs should rely primarily on attack detection. It proposes a risk-based architecture where lower-risk endpoints use detection and anomaly analysis, while high-risk functions require validation of structure, authorization, context, and business logic. The paper concludes that effective WAF security is fundamentally a risk-routing problem.