# Web application firewalls: what AI models recommend, October 2026

Gane Index, October 2026 Edition. Asked as "web application firewall" and as "WAF and bot protection service", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/network/web-application-firewalls/2026-10

This is the permanent record of the October 2026 Edition, published October 1, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/network/web-application-firewalls/index.md

**Standing:** Cloudflare WAF leads with 69% of first choices; verdict clear leader. 51 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Cloudflare WAF](https://www.gane.ai/index/it/vendors/cloudflare-waf/index.md) | 69% | 7% | 67 |
| 2 | [ModSecurity](https://www.gane.ai/index/it/vendors/modsecurity/index.md) | 8% | 54% | 26 |
| 3 | [AWS WAF](https://www.gane.ai/index/it/vendors/aws-waf/index.md) | 4% | 20% | 54 |
| 6 | [Radware Cloud WAF](https://www.gane.ai/index/it/vendors/radware-cloud-waf/index.md) | 2% | 17% | 12 |
| 12 | [Imperva Cloud WAF](https://www.gane.ai/index/it/vendors/imperva-cloud-waf/index.md) | 0% | 19% | 43 |
| 13 | [Fastly Next-Gen WAF](https://www.gane.ai/index/it/vendors/fastly-next-gen-waf/index.md) | 0% | 9% | 22 |
| 14 | [Akamai App & API Protector](https://www.gane.ai/index/it/vendors/akamai-app-api-protector/index.md) | 0% | 23% | 30 |
| 15 | [Sucuri WAF](https://www.gane.ai/index/it/vendors/sucuri-waf/index.md) | 0% | 6% | 17 |
| 17 | [F5 BIG-IP Advanced WAF](https://www.gane.ai/index/it/vendors/f5-big-ip-advanced-waf/index.md) | 0% | 24% | 21 |
| 18 | [Fortinet FortiWeb](https://www.gane.ai/index/it/vendors/fortinet-fortiweb/index.md) | 0% | 10% | 10 |
| 22 | [Azure WAF](https://www.gane.ai/index/it/vendors/azure-waf/index.md) | 0% | 31% | 16 |

Rank is by share of first choices among all 81 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: AWS WAF, Cloudflare WAF
- GPT-5.4 mini: Cloudflare WAF; alternatives Imperva Cloud WAF
- Gemini 3.5 Flash: Cloudflare WAF; alternatives AWS WAF, Barracuda WAF-as-a-Service, Fastly Next-Gen WAF
- Perplexity Sonar: Barracuda WAF; alternatives Akamai App & API Protector, Cloudflare WAF, Imperva Cloud WAF
- Grok 4.20: Cloudflare WAF; alternatives AWS WAF, Akamai App & API Protector, Azure Application Gateway WAF, Imperva Cloud WAF
- Mistral Small: Barracuda Web Application Firewall; alternatives Cloudflare WAF, Imperva Cloud WAF, Reblaze WAAP
- DeepSeek V4 Flash: Cloudflare WAF; alternatives AWS WAF, Fastly Next-Gen WAF
- Llama 4 Maverick: Radware Cloud WAF
- Qwen 3.7 Flash: Cloudflare WAF; alternatives AWS WAF, Fastly Next-Gen WAF, Imperva Cloud WAF
- Kimi K2: Cloudflare WAF; alternatives AWS WAF, Imperva Cloud WAF
- GLM 4.7 FlashX: Cloudflare WAF; alternatives AWS WAF, F5 Advanced WAF, Imperva Cloud WAF
- MiniMax M2.5: Barracuda Web Application Firewall, Cloudflare WAF; alternatives OpenAppSec / Check Point CloudGuard WAF
- GPT-6 Luna: Cloudflare WAF; alternatives AWS WAF, Azure Front Door Premium with WAF, Fastly Next-Gen WAF
- Muse Glimmer 30B: Cloudflare WAF; alternatives Barracuda WAF, Sucuri WAF

## Sources the answers cite

69 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- radware.com: 39 answers, 76 citations
- imperva.com: 28 answers, 36 citations
- wafplanet.com: 23 answers, 43 citations
- indusface.com: 21 answers, 23 citations
- openappsec.io: 19 answers, 21 citations
- cybersecuritynews.com: 18 answers, 21 citations
- checkpoint.com: 17 answers, 20 citations
- fortinet.com: 16 answers, 21 citations

Pages named in the most answers:

- https://radware.com/cyberpedia/application-security/most-reliable-web-application-firewalls (23 answers)
- https://imperva.com/blog/best-waap-solutions (19 answers)
- https://indusface.com/blog/best-cloud-waap-waf-software (17 answers)
- https://comparitech.com/net-admin/best-web-application-firewall (15 answers)
- https://cyberpress.org/waf-solutions-by-business-size (15 answers)
- https://openappsec.io/post/best-waf-solutions-in-2024-2025-real-world-comparison (15 answers)
- https://wafplanet.com/ (14 answers)
- https://expertinsights.com/network-security/the-top-web-application-firewalls (13 answers)
- https://guideflow.com/blog/web-application-firewall-software (13 answers)
- https://cybersecuritynews.com/best-web-application-firewall-solutions (12 answers)

## Warned against

- ModSecurity: 14 of 26 labels negative. "ModSecurity, the classic open-source WAF engine, has reached End-of-Life (EOL)." (Gemini 3.5 Flash, budget prompt)
- AWS WAF: 11 of 54 labels negative. "using the provider's native WAF (e.g., AWS WAF) is highly convenient... but may require more manual configuration and rule writing" (Gemini 3.5 Flash, scale prompt)
- Akamai App & API Protector: 7 of 30 labels negative. "if you configure your WAF/CDN (like Cloudflare or Akamai) but fail to implement proper Origin Access Controls... you have effectively bypassed the WAF" (GLM 4.7 FlashX, negative prompt)
- Azure WAF: 5 of 16 labels negative. "1,207 bypasses across AWS WAF, Azure WAF, Google Cloud Armor, Cloudflare, and ModSecurity" (DeepSeek V4 Flash, negative prompt)

## Movement since September 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Cloudflare WAF at 67%.

- Cloudflare WAF: 89% to 67%, −22. Cleared the floor by 11 points · rank 1 of 79, unchanged.
- ModSecurity: 0% to 7%, +7. Inside the floor by 4 points · rank 64 → 2 of 79.
- Barracuda Web Application Firewall: 0% to 5%, +5. Inside the floor by 6 points · rank 8 → 4 of 79.
- Radware Cloud WAF: 0% to 2%, +2. Inside the floor by 9 points · rank 21 → 6 of 79.
- Fastly Next-Gen WAF: 2% to 0%, −2. Inside the floor by 9 points · rank 3 → 13 of 79.
- Sucuri WAF: 2% to 0%, −2. Inside the floor by 9 points · rank 4 → 14 of 79.
- AWS WAF: 4% to 5%, +1. Inside the floor by 10 points · rank 2 → 3 of 79.
- Imperva Cloud WAF: 0% to 0%, ±0. Inside the floor by 11 points · rank 6 → 12 of 79.
- Akamai App & API Protector: 0% to 0%, ±0. Inside the floor by 11 points · rank 7 → 15 of 79.
- F5 BIG-IP Advanced WAF: 0% to 0%, ±0. Inside the floor by 11 points · rank 12 → 17 of 79.
- Azure WAF: 0% to 0%, ±0. Inside the floor by 11 points · rank 15 → 19 of 79.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, October 2026 Edition, www.gane.ai/index/it.