# Web application firewalls: what AI models recommend, September 2026

Gane Index, September 2026 Edition. Asked as "web application firewall" and as "WAF and bot protection service", six framings each, to twelve models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/network/web-application-firewalls/2026-09

This is the permanent record of the September 2026 Edition, published September 17, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/network/web-application-firewalls/index.md

**Standing:** Cloudflare WAF leads with 89% of first choices; verdict clear leader. 45 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Cloudflare WAF](https://www.gane.ai/index/it/vendors/cloudflare-waf/index.md) | 89% | 5% | 62 |
| 2 | [AWS WAF](https://www.gane.ai/index/it/vendors/aws-waf/index.md) | 4% | 12% | 40 |
| 3 | [Fastly Next-Gen WAF](https://www.gane.ai/index/it/vendors/fastly-next-gen-waf/index.md) | 2% | 14% | 22 |
| 4 | [Sucuri WAF](https://www.gane.ai/index/it/vendors/sucuri-waf/index.md) | 2% | 10% | 10 |
| 6 | [Imperva Cloud WAF](https://www.gane.ai/index/it/vendors/imperva-cloud-waf/index.md) | 0% | 29% | 41 |
| 7 | [Akamai App & API Protector](https://www.gane.ai/index/it/vendors/akamai-app-api-protector/index.md) | 0% | 20% | 30 |
| 8 | [Barracuda Web Application Firewall](https://www.gane.ai/index/it/vendors/barracuda-web-application-firewall/index.md) | 0% | 18% | 17 |
| 64 | [ModSecurity](https://www.gane.ai/index/it/vendors/modsecurity/index.md) | 0% | 56% | 18 |

Rank is by share of first choices among all 64 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: AWS WAF, Cloudflare WAF; alternatives Fortinet FortiWAF
- GPT-5.4 mini: Cloudflare WAF; alternatives AWS WAF, Akamai App & API Protector, F5 Distributed Cloud WAF
- Gemini 3.5 Flash: Cloudflare WAF; alternatives Fastly Next-Gen WAF, Imperva Cloud WAF
- Perplexity Sonar: Cloudflare WAF; alternatives AWS WAF, Azure WAF, Barracuda Web Application Firewall
- Grok 4.20: Cloudflare WAF; alternatives Barracuda WAF
- Mistral Small: Cloudflare WAF; alternatives Barracuda WAF
- DeepSeek V4 Flash: Cloudflare WAF; alternatives AWS WAF, Barracuda Web Application Firewall
- Llama 4 Maverick: Cloudflare WAF; alternatives Barracuda Web Application Firewall, Fastly Next-Gen WAF
- Qwen 3.7 Flash: Cloudflare WAF; alternatives AWS WAF, Imperva Cloud WAF
- Kimi K2: Cloudflare WAF; alternatives Barracuda WAF
- GLM 4.7 FlashX: Cloudflare WAF; alternatives AWS WAF, Barracuda Web Application Firewall, F5 BIG-IP
- MiniMax M2.5: Cloudflare WAF; alternatives AWS WAF, Barracuda Web Application Firewall, Imperva Cloud WAF

## Sources the answers cite

62 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- openappsec.io: 37 answers, 52 citations
- cybersecuritynews.com: 35 answers, 51 citations
- wafplanet.com: 31 answers, 51 citations
- cyberpress.org: 30 answers, 30 citations
- expertinsights.com: 25 answers, 25 citations
- radware.com: 18 answers, 31 citations
- imperva.com: 18 answers, 21 citations
- fastly.com: 16 answers, 20 citations

Pages named in the most answers:

- https://cyberpress.org/waf-solutions-by-business-size (29 answers)
- https://expertinsights.com/network-security/the-top-web-application-firewalls (25 answers)
- https://openappsec.io/post/best-waf-solutions-in-2024-2025-real-world-comparison (23 answers)
- https://openappsec.io/post/best-waf-solutions-in-2026-real-world-comparison (20 answers)
- https://cybersecuritynews.com/best-web-application-firewall-solutions (19 answers)
- https://wafplanet.com/ (17 answers)
- https://cybersecuritynews.com/best-web-application-firewall-waf (16 answers)
- https://cybersecuritynews.com/best-web-application-firewall-solutions/amp (15 answers)
- https://geekflare.com/cybersecurity/best-web-application-firewall (15 answers)
- https://fastly.com/blog/best-waf-solutions-2025-2026 (13 answers)

## Warned against

- ModSecurity: 10 of 18 labels negative. "Avoid: Unmanaged Open Source (ModSecurity/CoreRuleSet) ... Do not install this unless you have a dedicated security engineer" (Qwen 3.7 Flash, negative prompt)
- Imperva Cloud WAF: 12 of 41 labels negative. "Avoid assuming Imperva's signature protections are sufficient — independent tests show they miss most attacks." (DeepSeek V4 Flash, negative prompt)
- Akamai App & API Protector: 6 of 30 labels negative. "Why Not Akamai or Enterprise F5 for Mid-Market? ... you're paying for capacity you don't need." (Kimi K2, paraphrase prompt)
- AWS WAF: 5 of 40 labels negative. "Out of the box, AWS WAF is essentially a blank canvas... It requires deep cloud-engineering expertise to manage, meaning high operational overhead" (Gemini 3.5 Flash, direct prompt)

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, September 2026 Edition, www.gane.ai/index/it.