# Web application firewalls for enterprise buyers: what AI models recommend, October 2026

Gane Index, October 2026 Edition. Asked as "web application firewall" and as "WAF and bot protection service", six framings each, to fourteen models with search on, on behalf of an enterprise B2B company. Page: https://www.gane.ai/index/it/network/web-application-firewalls/2026-10/enterprise

This is the permanent record of the October 2026 Edition, published October 1, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/network/web-application-firewalls/enterprise/index.md

**Standing:** Cloudflare WAF leads with 59% of first choices; verdict clear leader. 51 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Cloudflare WAF](https://www.gane.ai/index/it/vendors/cloudflare-waf/index.md) | 59% | 3% | 64 |
| 2 | [Akamai App & API Protector](https://www.gane.ai/index/it/vendors/akamai-app-api-protector/index.md) | 16% | 8% | 50 |
| 3 | [Imperva Cloud WAF](https://www.gane.ai/index/it/vendors/imperva-cloud-waf/index.md) | 12% | 11% | 61 |
| 4 | [F5 BIG-IP Advanced WAF](https://www.gane.ai/index/it/vendors/f5-big-ip-advanced-waf/index.md) | 4% | 18% | 28 |
| 5 | [Fastly Next-Gen WAF](https://www.gane.ai/index/it/vendors/fastly-next-gen-waf/index.md) | 4% | 14% | 22 |
| 6 | [AWS WAF](https://www.gane.ai/index/it/vendors/aws-waf/index.md) | 2% | 30% | 50 |
| 10 | [Fortinet FortiWeb](https://www.gane.ai/index/it/vendors/fortinet-fortiweb/index.md) | 0% | 14% | 14 |
| 11 | [Radware Cloud WAF](https://www.gane.ai/index/it/vendors/radware-cloud-waf/index.md) | 0% | 21% | 14 |
| 84 | [Azure WAF](https://www.gane.ai/index/it/vendors/azure-waf/index.md) | 0% | 53% | 17 |

Rank is by share of first choices among all 85 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: no first choice
- GPT-5.4 mini: F5 BIG-IP Advanced WAF; alternatives Akamai App & API Protector, Cloudflare WAF, Imperva Cloud WAF
- Gemini 3.5 Flash: Fastly Next-Gen WAF; alternatives Akamai App & API Protector, Cloudflare WAF, Imperva Cloud WAF
- Perplexity Sonar: Akamai App & API Protector; alternatives AWS WAF, Azure WAF, Cloudflare WAF, Imperva Cloud WAF
- Grok 4.20: Cloudflare WAF; alternatives Akamai App & API Protector, F5 Advanced WAF, Imperva Cloud WAF
- Mistral Small: Akamai App & API Protector, Imperva Cloud WAF; alternatives AWS WAF
- DeepSeek V4 Flash: Cloudflare WAF; alternatives Akamai App & API Protector, F5 BIG-IP Advanced WAF, Imperva Cloud WAF, Radware Cloud WAF
- Llama 4 Maverick: Akamai App & API Protector, F5 BIG-IP Advanced WAF, Imperva Cloud WAF
- Qwen 3.7 Flash: Cloudflare WAF; alternatives F5 BIG-IP Advanced WAF, Imperva Cloud WAF, Imperva SecureSphere
- Kimi K2: Cloudflare WAF, Imperva Cloud WAF; alternatives AWS WAF, F5 BIG-IP Advanced WAF, Fortinet FortiWeb
- GLM 4.7 FlashX: Imperva Cloud WAF; alternatives Cloudflare WAF, F5 BIG-IP
- MiniMax M2.5: Cloudflare WAF; alternatives AWS WAF, Akamai WAF, F5 BIG-IP WAF, Imperva Cloud WAF
- GPT-6 Luna: Cloudflare WAF; alternatives AWS WAF, Akamai App & API Protector, F5 Distributed Cloud WAAP
- Muse Glimmer 30B: Akamai App & API Protector, Cloudflare WAF; alternatives F5 BIG-IP Advanced WAF, Imperva Cloud WAF

## Sources the answers cite

78 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- radware.com: 45 answers, 96 citations
- imperva.com: 42 answers, 62 citations
- openappsec.io: 30 answers, 33 citations
- cybersecuritynews.com: 29 answers, 37 citations
- wafplanet.com: 27 answers, 37 citations
- gartner.com: 19 answers, 37 citations
- fastly.com: 18 answers, 22 citations
- fortinet.com: 18 answers, 22 citations

Pages named in the most answers:

- https://imperva.com/blog/best-waap-solutions (33 answers)
- https://openappsec.io/post/best-waf-solutions-in-2024-2025-real-world-comparison (21 answers)
- https://radware.com/cyberpedia/application-security/most-reliable-web-application-firewalls (20 answers)
- https://cybersecuritynews.com/best-web-application-firewall-waf (17 answers)
- https://guideflow.com/blog/web-application-firewall-software (16 answers)
- https://ciopages.com/buyer-guides/web-application-firewall (15 answers)
- https://expertinsights.com/network-security/the-top-web-application-firewalls (15 answers)
- https://geekflare.com/guides/best-web-application-firewall (15 answers)
- https://comparitech.com/net-admin/best-web-application-firewall (13 answers)
- https://myrasecurity.com/en/best-waf-providers (13 answers)

## Warned against

- AWS WAF: 15 of 50 labels negative. "Avoid usage-based for predictability: AWS WAF/Azure WAF/Fastly charge per Web ACL ... costs explode at scale" (Grok 4.20, budget prompt)
- Azure WAF: 9 of 17 labels negative. "Avoid usage-based for predictability: AWS WAF/Azure WAF/Fastly charge per Web ACL" (Grok 4.20, budget prompt)
- ModSecurity: 7 of 8 labels negative. "Be cautious with ... open-source/modular stacks such as ModSecurity and PHPIDS, which academic and grey literature consistently show higher exploitable bypass rates" (Muse Glimmer 30B, negative prompt)
- Imperva Cloud WAF: 7 of 61 labels negative. "Imperva's WAF achieves only 11.97% security effectiveness, missing 88.03% of actual threats" (Claude Haiku 4.5, negative prompt)

## Movement since September 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Cloudflare WAF at 57%.

- Akamai App & API Protector: 22% to 14%, −8. Inside the floor by 3 points · rank 2 → 3 of 73.
- Imperva Cloud WAF: 9% to 14%, +5. Inside the floor by 6 points · rank 3 → 2 of 73.
- F5 BIG-IP Advanced WAF: 0% to 5%, +5. Inside the floor by 6 points · rank 11 → 4 of 73.
- Cloudflare WAF: 53% to 57%, +4. Inside the floor by 7 points · rank 1 of 73, unchanged.
- Fastly Next-Gen WAF: 2% to 5%, +3. Inside the floor by 8 points · rank 4 → 5 of 73.
- AWS WAF: 2% to 2%, ±0. Inside the floor by 11 points · rank 5 → 6 of 73.
- Fortinet FortiWeb: 0% to 0%, ±0. Inside the floor by 11 points · rank 13 → 10 of 73.
- Radware Cloud WAF: 0% to 0%, ±0. Inside the floor by 11 points · rank 12 → 11 of 73.
- Azure WAF: 0% to 0%, ±0. Inside the floor by 11 points · rank 48 → 72 of 73.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, October 2026 Edition, www.gane.ai/index/it.