# Web application firewalls for enterprise buyers: what AI models recommend, September 2026

Gane Index, September 2026 Edition. Asked as "web application firewall" and as "WAF and bot protection service", six framings each, to twelve models with search on, on behalf of an enterprise B2B company. Page: https://www.gane.ai/index/it/network/web-application-firewalls/2026-09/enterprise

This is the permanent record of the September 2026 Edition, published September 17, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/network/web-application-firewalls/enterprise/index.md

**Standing:** Cloudflare WAF leads with 53% of first choices; verdict clear leader. 45 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Cloudflare WAF](https://www.gane.ai/index/it/vendors/cloudflare-waf/index.md) | 53% | 7% | 59 |
| 2 | [Akamai App & API Protector](https://www.gane.ai/index/it/vendors/akamai-app-api-protector/index.md) | 22% | 4% | 51 |
| 3 | [Imperva Cloud WAF](https://www.gane.ai/index/it/vendors/imperva-cloud-waf/index.md) | 9% | 10% | 50 |
| 4 | [Fastly Next-Gen WAF](https://www.gane.ai/index/it/vendors/fastly-next-gen-waf/index.md) | 2% | 10% | 20 |
| 5 | [AWS WAF](https://www.gane.ai/index/it/vendors/aws-waf/index.md) | 2% | 35% | 48 |
| 11 | [F5 BIG-IP Advanced WAF](https://www.gane.ai/index/it/vendors/f5-big-ip-advanced-waf/index.md) | 0% | 14% | 28 |
| 12 | [Radware Cloud WAF](https://www.gane.ai/index/it/vendors/radware-cloud-waf/index.md) | 0% | 12% | 16 |
| 13 | [Fortinet FortiWeb](https://www.gane.ai/index/it/vendors/fortinet-fortiweb/index.md) | 0% | 17% | 18 |
| 48 | [Azure WAF](https://www.gane.ai/index/it/vendors/azure-waf/index.md) | 0% | 40% | 15 |

Rank is by share of first choices among all 66 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: no first choice
- GPT-5.4 mini: Cloudflare WAF; alternatives AWS WAF, Azure WAF, F5 Distributed Cloud WAF
- Gemini 3.5 Flash: Cloudflare WAF, Fastly Next-Gen WAF; alternatives Akamai App & API Protector, F5 Distributed Cloud WAF, Imperva Cloud WAF
- Perplexity Sonar: Cloudflare WAF; alternatives AWS WAF, Akamai App & API Protector, Azure WAF, Imperva Cloud WAF
- Grok 4.20: Imperva Cloud WAF; alternatives Akamai App & API Protector, Cloudflare WAF
- Mistral Small: Akamai App & API Protector, Imperva Cloud WAF; alternatives Cloudflare WAF
- DeepSeek V4 Flash: Cloudflare WAF; alternatives AWS WAF, Akamai App & API Protector, Azure WAF, Imperva Cloud WAF
- Llama 4 Maverick: no first choice
- Qwen 3.7 Flash: Cloudflare WAF; alternatives AWS WAF, Akamai App & API Protector, F5 BIG-IP Advanced WAF, Imperva Cloud WAF
- Kimi K2: Akamai App & API Protector, Cloudflare WAF; alternatives AWS WAF, F5 BIG-IP Advanced WAF, Imperva Cloud WAF
- GLM 4.7 FlashX: Imperva Cloud WAF; alternatives AWS WAF, Akamai App & API Protector, Cloudflare WAF, F5 BIG-IP Advanced WAF
- MiniMax M2.5: Akamai App & API Protector; alternatives Fastly Next-Gen WAF, Imperva Cloud WAF, Radware Cloud WAF, open-appsec

## Sources the answers cite

64 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- expertinsights.com: 41 answers, 41 citations
- imperva.com: 39 answers, 52 citations
- cybersecuritynews.com: 34 answers, 53 citations
- wafplanet.com: 32 answers, 48 citations
- openappsec.io: 25 answers, 31 citations
- cyberpress.org: 25 answers, 27 citations
- radware.com: 20 answers, 35 citations
- g2.com: 15 answers, 16 citations

Pages named in the most answers:

- https://expertinsights.com/network-security/the-top-web-application-firewalls (41 answers)
- https://imperva.com/blog/best-waap-solutions (30 answers)
- https://cyberpress.org/waf-solutions-by-business-size (25 answers)
- https://cybersecuritynews.com/best-web-application-firewall-solutions/amp (25 answers)
- https://wafplanet.com/ (21 answers)
- https://cybersecuritynews.com/best-web-application-firewall-waf (19 answers)
- https://openappsec.io/post/best-waf-solutions-in-2024-2025-real-world-comparison (16 answers)
- https://guptadeepak.com/tools/top-5-waf-web-application-firewall-tools-2026 (14 answers)
- https://guideflow.com/blog/web-application-firewall-software (13 answers)
- https://openappsec.io/post/best-waf-solutions-in-2026-real-world-comparison (12 answers)

## Warned against

- AWS WAF: 17 of 48 labels negative. "What to Avoid for Predictable Costs: ... AWS WAF | Usage-based | $0.60 per million requests + per-rule fees; costs spike during attacks" (Kimi K2, budget prompt)
- Imperva Cloud WAF: 5 of 50 labels negative. "Independent testing showed only 11.97% true positive rate — missing ~88% of actual threats" (Kimi K2, negative prompt)
- Azure WAF: 6 of 15 labels negative. "You should avoid providers that charge strictly "per request" (like standard AWS WAF or Azure WAF setups)" (Qwen 3.7 Flash, budget prompt)
- Cloudflare WAF: 4 of 59 labels negative. "Cloudflare requires deep customization and granular logging to be pushed into enterprise tiers, and requires that you route traffic through a third-party edge" (Claude Haiku 4.5, negative prompt)

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, September 2026 Edition, www.gane.ai/index/it.