Web application firewalls for enterprise buyers
Asked as “web application firewall”, and as “WAF and bot protection service”, on behalf of an enterprise B2B company. 45 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing · first-choice share
53%
Clear leader
53Cloudflare WAF22Akamai App & API Protector09Imperva Cloud WAF16others
53% of first choices, clear leader.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
Show the four products at 0%, ordered by negative rate
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Head to headHead-to-head pages are published for mid-market buyers, so these open on mid-market figures, not enterprise.
All six head-to-head pages: the top four products, each against each
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative70%
Key
01Cloudflare WAF53%
Cloudflare WAF53%02Akamai App & API Protector22%
Akamai App & API Protector22%03Imperva Cloud WAF9%
Imperva Cloud WAF9%04Fastly Next-Gen WAF2%
Fastly Next-Gen WAF2%05AWS WAF2%
AWS WAF2%06F5 BIG-IP Advanced WAF0%
F5 BIG-IP Advanced WAF0%07Radware Cloud WAF0%
Radware Cloud WAF0%08Fortinet FortiWeb0%
Fortinet FortiWeb0%09Azure WAF0%
Azure WAF0%What they warned about
Three of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.20, Mistral Small, DeepSeek V4 Flash, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
AWS WAF35%
17 of 48 labels negative · 9 of 12 models · 6 hard negative
“What to Avoid for Predictable Costs: ... AWS WAF | Usage-based | $0.60 per million requests + per-rule fees; costs spike during attacks” Kimi K2, budget prompt
Imperva Cloud WAF10%
5 of 50 labels negative · 5 of 12 models · 1 hard negative
“Independent testing showed only 11.97% true positive rate — missing ~88% of actual threats” Kimi K2, negative prompt
Azure WAF40%
6 of 15 labels negative · 4 of 12 models · 3 hard negative
“You should avoid providers that charge strictly "per request" (like standard AWS WAF or Azure WAF setups)” Qwen 3.7 Flash, budget prompt
Cloudflare WAF7%
4 of 59 labels negative · 4 of 12 models
“Cloudflare requires deep customization and granular logging to be pushed into enterprise tiers, and requires that you route traffic through a third-party edge” Claude Haiku 4.5, negative prompt
What they cite
Twelve of the twelve models returned a source list in this edition: four return the pages they cited and eight the search results they consulted.
Sites the answers cite
64 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 926 links across 217 sites, every framing counted. Ranked by the number of answers carrying the site or page.
41 answers · 41 citations · 10 models
vendor site · Imperva39 answers · 52 citations · 12 models
34 answers · 53 citations · 10 models
32 answers · 48 citations · 11 models
vendor site · open-appsec25 answers · 31 citations · 10 models
vendor site · CyberPress25 answers · 27 citations · 9 models
vendor site · Radware20 answers · 35 citations · 8 models
vendor site · G215 answers · 16 citations · 9 models
vendor site · Guideflow15 answers · 15 citations · 10 models
15 answers · 15 citations · 5 models
vendor site · Fortinet14 answers · 15 citations · 9 models
vendor site · Indusface14 answers · 14 citations · 9 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
41 answers · 10 models
30 answers · 11 models
25 answers · 9 models
25 answers · 9 models
21 answers · 9 models
19 answers · 9 models
16 answers · 7 models
14 answers · 4 models
13 answers · 9 models
12 answers · 9 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best web application firewall”, “web application firewall”, “web application firewalls”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days |
|---|---|---|---|---|---|---|---|
| Cloudflare parent site Cloudflare WAF 53%, Cloudflare One 0% | 53% | 355 | 550,000 | 10,897 | |||
| Akamai parent site Akamai App & API Protector 22%, Akamai Bot Manager 2%, Akamai Kona Site Defender 2% | 27% | 131 | 27,100 | 1,614 | |||
| Imperva Cloud WAF imperva.com | 9% | 124 | 90 | 2 | 417,309 | ||
| Fastly Next-Gen WAF fastly.com | 2% | 61 | 70 | 0 | 107,961 | $2,460 | 120 |
| AWS parent site AWS WAF 2%, AWS WAF + Bot Control 0%, AWS Shield 0% | 2% | 154 | 368,000 | 114,001 | |||
| AWS CloudFront Flat-Rate Pricing Plans | 2% | ||||||
| Akamaya App & API Protector | 2% | ||||||
| NetScaler Web Application Firewall | 2% | ||||||
| F5 BIG-IP Advanced WAF f5.com | 0% | 50 | 50 | 0 | 178,423 | $5 | 120 |
| Radware Cloud WAF radware.com | 0% | 36 | 30 | 0 | 43,076 | $21 | 13 |
Google's top ten for the three searches hold 24 sites; 3 of them are among the sites the models cited here (fortinet.com, indusface.com, openappsec.io). The first result for “best web application firewall” is gartner.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best web application firewall for an enterprise B2B company?”Paraphrase“Which WAF and bot protection service would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade web application firewalls and how do they differ?”Budget-constrained“What is the best web application firewall for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating a web application firewall. What should we look at?”Negative“Which web application firewalls should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5no first choiceAkamai App & API ProtectorChangedCloudflare WAFNetScaler Web Application Firewallagainst: AWS WAFno first choiceagainst: Cloudflare WAF, F5 Advanced WAF, Sucuri WAF
Three alternatives
AWS WAF, Cloudflare WAF, Imperva Cloud WAFThree alternatives
AWS WAF, Akamai App & API Protector, Imperva Cloud WAFOne alternative
Cloudflare WAFGPT-5.4 miniCloudflare WAFAkamai Bot Manager, Akamai Kona Site Defender, Cloudflare WAFChangedno first choiceCloudflare WAFagainst: AWS WAFno first choicenothing named
Three alternatives
AWS WAF, Azure WAF, F5 Distributed Cloud WAFThree alternatives
AWS WAF, AWS WAF + Bot Control, F5 Distributed Cloud WAAPOne alternative
Imperva Cloud WAFGemini 3.5 FlashCloudflare WAF, Fastly Next-Gen WAFCloudflare WAFChangedImperva Cloud WAFAWS CloudFront Flat-Rate Pricing Plans, Cloudflare WAFno first choiceagainst: AWS WAF, Azure WAF, Citrix NetScaler, F5 BIG-IP, GCP Cloud Armor, ModSecurity, Nginx ModSecurity WAF, Radware Cloud WAF
Three alternatives
Akamai App & API Protector, F5 Distributed Cloud WAF, Imperva Cloud WAFThree alternatives
Akamai App & API Protector, DataDome, HUMAN Bot DefenderSix alternatives
AWS WAF, Akamai App & API Protector, Azure WAF, Cloudflare WAF, F5 Distributed Cloud WAAP, Fastly Next-Gen WAFFour alternatives
Cloudflare One, F5 BIG-IP Advanced WAF, Fastly Next-Gen WAF, Zscaler Private Access (ZPA) + Zscaler Internet AccessPerplexity SonarCloudflare WAFAkamai App & API ProtectorChangedagainst: AWS WAFno first choiceCloudflare WAFagainst: F5 BIG-IP Advanced WAFno first choiceagainst: AWS WAF, Barracuda WAF, Cloudflare WAF, F5 BIG-IP Advanced WAF, Fortinet FortiWeb, Prophaze WAF, Sucuri WAF
Five alternatives
AWS WAF, Akamai App & API Protector, Azure WAF, Imperva Cloud WAF, Radware Cloud WAFTwo alternatives
Cloudflare WAF, Imperva Cloud WAFOne alternative
Akamai App & API ProtectorGrok 4.20Imperva Cloud WAFAkamai App & API ProtectorChangedagainst: AWS WAFCloudflare WAFCloudflare WAFagainst: AWS WAF, Akamai App & API Protector, Azure, F5 Advanced WAF, GCP, Imperva Cloud WAFCloudflare WAFagainst: AWS WAF, Barracuda WAF, F5 BIG-IP Advanced WAF, Google Cloud Armor, Microsoft Azure WAF, ModSecurity-based standalone/open-source WAFs
Two alternatives
Akamai App & API Protector, Cloudflare WAFTwo alternatives
Cloudflare WAF, Imperva Cloud WAFFour alternatives
AWS WAF, Akamai App & API Protector, F5 BIG-IP Advanced WAF, Imperva Cloud WAFThree alternatives
AWS WAF, Akamai App & API Protector, Imperva Cloud WAFMistral SmallAkamai App & API Protector, Imperva Cloud WAFAkamai App & API ProtectorChangedImperva Cloud WAFAWS WAF, Cloudflare WAFno first choicenothing named
One alternative
Cloudflare WAFTwo alternatives
Cisco Secure WAF, Indusface AppTranaFive alternatives
Akamai App & API Protector, Cloudflare WAF, F5 BIG-IP Advanced WAF, Fastly Next-Gen WAF, open-appsecTwo alternatives
F5 BIG-IP Advanced WAF, Imperva Cloud WAFDeepSeek V4 FlashCloudflare WAFAkamai App & API Protector, Cloudflare WAFChangedagainst: AWS WAFCloudflare WAFCloudflare WAFagainst: AWS WAF, Azure, Fastly Next-Gen WAF, Google Cloud ArmorCloudflare WAFagainst: AWS WAFagainst: Barracuda Web Application Firewall, Cloudflare WAF, F5 NGINX ModSecurity WAF, Imperva Cloud WAF, ModSecurity
Four alternatives
AWS WAF, Akamai App & API Protector, Azure WAF, Imperva Cloud WAFOne alternative
Imperva Cloud WAFSeven alternatives
AWS WAF, Akamai App & API Protector, F5 BIG-IP Advanced WAF, Fastly Next-Gen WAF, Google Cloud Armor, Imperva Cloud WAF, Microsoft Azure WAFOne alternative
Akamai App & API ProtectorThree alternatives
Akamai App & API Protector, F5 BIG-IP Advanced WAF, Imperva Cloud WAFLlama 4 Maverickno first choiceno first choiceHeldno first choiceCloudflare WAFno first choiceagainst: Imperva Cloud WAF
Three alternatives
AWS WAF, Azure Web Application Firewall, Imperva Cloud WAFQwen 3.7 FlashCloudflare WAFCloudflare WAFHeldF5 BIG-IP Advanced WAF, Imperva Cloud WAFCloudflare WAFagainst: AWS WAF, Azure WAFno first choiceagainst: AWS WAF, Azure WAF
Four alternatives
AWS WAF, Akamai App & API Protector, F5 BIG-IP Advanced WAF, Imperva Cloud WAFFive alternatives
AWS Shield, AWS WAF, Akamai App & API Protector, Azure Front Door, Radware Cloud WAFThree alternatives
AWS WAF, Akamai App & API Protector, Cloudflare WAFTwo alternatives
F5 BIG-IP Advanced WAF, Fortinet FortiWebKimi K2Akamai App & API Protector, Cloudflare WAFAkamai App & API Protector, Cloudflare WAFHeldagainst: AWS Bot Control, AWS WAFCloudflare WAFCloudflare WAFagainst: AWS WAF, Azure WAF, GCP Cloud Armorno first choiceagainst: AWS WAF, Azure WAF, GCP Cloud Armor, Imperva Cloud WAF, ModSecurity
Three alternatives
AWS WAF, F5 BIG-IP Advanced WAF, Imperva Cloud WAFThree alternatives
F5 Distributed Cloud, Fastly Next-Gen WAF, Imperva Cloud WAFSeven alternatives
AWS WAF, Akamai App & API Protector, F5 BIG-IP Advanced WAF, Fastly Next-Gen WAF, Fortinet FortiWeb, Imperva Cloud WAF, Radware Cloud WAFOne alternative
Imperva Cloud WAFSeven alternatives
AWS WAF, Akamai App & API Protector, Azure WAF, Cloudflare WAF, F5 BIG-IP Advanced WAF, Fortinet FortiWeb, Imperva Cloud WAFGLM 4.7 FlashXImperva Cloud WAFagainst: Barracuda WAFAkamaya App & API ProtectorChangedno first choiceCloudflare WAFno first choiceagainst: F5 NGINX ModSecurity WAF, Fortinet FortiWeb, Hillstone Networks WAF, Qualys Web Application Firewall, StackPath WAF, Trustwave ModSecurity
Five alternatives
AWS WAF, Akamai App & API Protector, Cloudflare WAF, F5 BIG-IP Advanced WAF, Fortinet FortiWebTwo alternatives
F5 Advanced WAF, Imperva Cloud WAFNine alternatives
AWS WAF, Akamai App & API Protector, Barracuda Web Application Firewall, Cloudflare WAF, F5 BIG-IP Advanced WAF, Fastly Next-Gen WAF, Fortinet FortiWeb, Google Cloud Armor, Imperva Cloud WAFThree alternatives
AWS WAF, F5 BIG-IP Advanced WAF, Imperva Cloud WAFMiniMax M2.5Akamai App & API ProtectorAkamai App & API Protector, Imperva Cloud WAFChangedCloudflare WAFCloudflare WAFagainst: AWS WAF, Azure WAF, GCP Cloud Armorno first choiceagainst: Akamai App & API Protector, Cloudflare WAF, F5 BIG-IP Advanced WAF, Fastly Next-Gen WAF, Fortinet FortiWeb, Imperva Cloud WAF, Radware Cloud WAF
Four alternatives
Fastly Next-Gen WAF, Imperva Cloud WAF, Radware Cloud WAF, open-appsecTwo alternatives
Cloudflare WAF, F5 BIG-IP Advanced WAFThree alternatives
AWS WAF, Akamai App & API Protector, Imperva Cloud WAFTwo alternatives
Akamai App & API Protector, Imperva Cloud WAFBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.
Seventy-two rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 12:42 | no | 0 | 4 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 12:08 | yes | 5 | 7 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 11:05 | yes | 7 | 18 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-09-17 12:28 | yes | 20 | 4 s |
| Direct recommendation | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 11:46 | yes | 28 | 13 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 14:03 | yes | 5 | 4 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 10:14 | yes | 10 | 13 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 09:41 | yes | 5 | 2 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 11:54 | no | 0 | 36 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 13:16 | yes | 15 | 26 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 09:30 | yes | 26 | 151 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 11:12 | yes | 5 | 17 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 11:09 | yes | 16 | 12 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 09:57 | yes | 4 | 5 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 12:38 | yes | 9 | 20 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-09-17 11:59 | yes | 17 | 6 s |
| Paraphrase | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 11:45 | yes | 34 | 15 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 09:36 | yes | 5 | 5 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 09:30 | yes | 18 | 16 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 12:52 | yes | 5 | 4 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 13:12 | yes | 5 | 33 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 11:41 | yes | 15 | 21 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 10:36 | yes | 27 | 200 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 12:30 | yes | 8 | 24 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 11:32 | yes | 9 | 8 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 13:31 | yes | 9 | 10 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 09:51 | yes | 14 | 34 s |
| Comparative | Perplexity Sonar | sonar | 2026-09-17 13:47 | yes | 15 | 9 s |
| Comparative | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 10:22 | yes | 25 | 14 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 09:32 | yes | 9 | 10 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 11:28 | yes | 16 | 24 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 11:02 | yes | 5 | 3 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 11:38 | no | 0 | 40 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 13:21 | yes | 8 | 36 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 12:03 | yes | 10 | 77 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 11:15 | yes | 5 | 18 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 12:57 | yes | 18 | 9 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 10:25 | yes | 3 | 4 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 11:02 | yes | 18 | 32 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-09-17 11:51 | yes | 20 | 6 s |
| Budget constrained | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 13:53 | yes | 35 | 20 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 12:14 | yes | 5 | 6 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 09:32 | yes | 23 | 21 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 10:43 | yes | 5 | 3 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 12:23 | yes | 17 | 127 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 13:38 | yes | 25 | 38 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 10:40 | yes | 23 | 82 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 14:13 | yes | 20 | 63 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 11:28 | no | 0 | 8 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 10:36 | no | 0 | 11 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 10:24 | yes | 10 | 30 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-09-17 09:52 | yes | 17 | 9 s |
| Scale constrained | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 10:08 | yes | 17 | 12 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 09:58 | no | 0 | 9 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 09:46 | yes | 10 | 16 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 11:48 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 14:12 | no | 0 | 34 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 11:09 | yes | 15 | 61 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 13:43 | yes | 14 | 83 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 11:02 | no | 0 | 65 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 14:15 | yes | 15 | 8 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 12:17 | yes | 4 | 7 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 14:11 | yes | 21 | 27 s |
| Negative framing | Perplexity Sonar | sonar | 2026-09-17 13:17 | yes | 15 | 9 s |
| Negative framing | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 10:42 | yes | 22 | 18 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 11:38 | yes | 5 | 6 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 09:33 | yes | 24 | 21 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 12:59 | yes | 5 | 4 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 14:01 | yes | 26 | 119 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 11:45 | yes | 25 | 42 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 10:19 | yes | 29 | 627 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 12:24 | yes | 21 | 74 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
AWS read as AWS WAF
Akamai read as Akamai App & API Protector
Akamai (Edge WAF) read as Akamai App & API Protector
Akamai (Kona Site Defender) read as Akamai App & API Protector
Akamai (Prolexic / Kona Site Defender) read as Akamai App & API Protector
Barracuda read as Barracuda Web Application Firewall
Cloudflare read as Cloudflare WAF
Cloudflare (Enterprise Plan) read as Cloudflare WAF
Cloudflare Enterprise read as Cloudflare WAF
Cloudflare Enterprise WAF read as Cloudflare WAF
Cloudflare WAAP read as Cloudflare WAF
Cloudflare WAAP (Cloudflare WAF) read as Cloudflare WAF
Cloudflare WAF / WAAP read as Cloudflare WAF
Cloudflare WAF/WAAP read as Cloudflare WAF
Cloudflare Web Application Firewall read as Cloudflare WAF
F5 read as F5 BIG-IP Advanced WAF
F5 (Advanced WAF / NGINX) read as F5 BIG-IP Advanced WAF
F5 (Advanced WAF – ASM) read as F5 BIG-IP Advanced WAF
F5 (Advanced WAF) read as F5 BIG-IP Advanced WAF
F5 (BIG-IP / NGINX App Protect) read as F5 BIG-IP Advanced WAF
F5 (including NGINX App Protect or Distributed Cloud) read as F5 BIG-IP Advanced WAF
F5 WAF read as F5 BIG-IP Advanced WAF
Fastly read as Fastly Next-Gen WAF
Fastly's Next-Gen WAF read as Fastly Next-Gen WAF
Fortinet read as Fortinet FortiWeb
Fortinet (FortiWeb) read as Fortinet FortiWeb
HUMAN Security (formerly White Ops) read as HUMAN Bot Defender
Imperva read as Imperva Cloud WAF
Imperva (Cloud WAF & SecureSphere) read as Imperva Cloud WAF
Imperva (Cloud WAF / WAAP) read as Imperva Cloud WAF
Imperva (SecureSphere / Cloud WAF) read as Imperva Cloud WAF
Imperva (by Thales) read as Imperva Cloud WAF
Imperva (formerly Incapsula) read as Imperva Cloud WAF
Imperva (now Thales) read as Imperva Cloud WAF
Imperva Cloud WAAP read as Imperva Cloud WAF
Imperva WAF read as Imperva Cloud WAF
Imperva WAF (Cloud‑Delivered) read as Imperva Cloud WAF
Imperva Web Application Firewall read as Imperva Cloud WAF
Open-appsec / CloudGuard read as open-appsec
Radware read as Radware Cloud WAF
Sucuri read as Sucuri WAF
open-appsec / CloudGuard WAF read as open-appsec
Unresolved, counted raw
AWS CloudFront Flat-Rate Pricing Plans
Akamaya App & API Protector
Cisco Secure WAF
Cisco's Advanced WAF and Bot Protection
Cloudflare's Web Security Platform
Cyber Security Cloud
Hillstone Networks WAF
Imperva's Advanced Bot Protection
ModSecurity-based standalone/open-source WAFs
NetScaler Web Application Firewall (Citrix)
Nginx ModSecurity WAF
Qualys Web Application Firewall
StackPath WAF
Trustwave ModSecurity
Discontinued, still offered
No shut-down product was recommended here.