# Web application firewalls for enterprise buyers: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "web application firewall" and as "WAF and bot protection service", six framings each, to fourteen models with search on, on behalf of an enterprise B2B company. Page: https://www.gane.ai/index/it/network/web-application-firewalls/2026-11/enterprise

**Standing:** Cloudflare WAF leads with 60% of first choices; verdict clear leader. 52 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Cloudflare WAF](https://www.gane.ai/index/it/vendors/cloudflare-waf/index.md) | 60% | 6% | 70 |
| 2 | [Imperva Cloud WAF](https://www.gane.ai/index/it/vendors/imperva-cloud-waf/index.md) | 19% | 12% | 66 |
| 3 | [Akamai App & API Protector](https://www.gane.ai/index/it/vendors/akamai-app-api-protector/index.md) | 8% | 16% | 63 |
| 10 | [Fastly Next-Gen WAF](https://www.gane.ai/index/it/vendors/fastly-next-gen-waf/index.md) | 0% | 19% | 36 |
| 11 | [Fortinet FortiWeb](https://www.gane.ai/index/it/vendors/fortinet-fortiweb/index.md) | 0% | 5% | 19 |
| 12 | [Radware Cloud WAF](https://www.gane.ai/index/it/vendors/radware-cloud-waf/index.md) | 0% | 6% | 18 |
| 13 | [F5 BIG-IP Advanced WAF](https://www.gane.ai/index/it/vendors/f5-big-ip-advanced-waf/index.md) | 0% | 29% | 31 |
| 52 | [AWS WAF](https://www.gane.ai/index/it/vendors/aws-waf/index.md) | 0% | 44% | 55 |
| 72 | [Azure WAF](https://www.gane.ai/index/it/vendors/azure-waf/index.md) | 0% | 58% | 24 |

Rank is by share of first choices among all 72 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Cloudflare WAF; alternatives AWS WAF, Barracuda WAF, F5 Advanced WAF, Fortinet FortiWeb
- GPT-5.4 mini: Akamai App & API Protector, Imperva Cloud WAF; alternatives AWS WAF, Azure WAF, Cloudflare WAF, F5 BIG-IP Advanced WAF
- Gemini 3.5 Flash: Cloudflare WAF; alternatives AWS WAF, Akamai App & API Protector, Azure WAF, Fastly Next-Gen WAF
- Perplexity Sonar: Imperva Cloud WAF; alternatives AWS WAF, Akamai App & API Protector, Cloudflare Application Security, F5 BIG-IP Advanced WAF
- Grok 4.20: Cloudflare WAF, Imperva Cloud WAF; alternatives F5 NGINX App Protect or BIG-IP, Fastly Next-Gen WAF, Radware Cloud WAF
- Mistral Small: Cloudflare WAF; alternatives Akamai App & API Protector, F5 BIG-IP Advanced WAF, Imperva Cloud WAF
- DeepSeek V4 Flash: Cloudflare WAF; alternatives Akamai App & API Protector, F5 Advanced WAF, Fastly Next-Gen WAF, Fortinet FortiWeb
- Llama 4 Maverick: Cloudflare WAF; alternatives Akamai App & API Protector, F5 BIG-IP Advanced WAF, Imperva Cloud WAF
- Qwen 3.7 Flash: Cloudflare WAF; alternatives AWS WAF, Azure WAF, F5 BIG-IP Advanced WAF, Fortinet FortiWeb
- Kimi K2: Imperva Cloud WAF; alternatives F5 Web App & API Protection, Fortinet FortiWeb
- GLM 4.7 FlashX: Cloudflare WAF; alternatives Akamai App & API Protector, F5 BIG-IP Advanced WAF, Imperva Cloud WAF, Radware Cloud WAF
- MiniMax M2.5: Imperva Cloud WAF; alternatives Akamai App & API Protector, Cloudflare WAF, F5 BIG-IP Advanced WAF
- GPT-6 Luna: Cloudflare WAF; alternatives AWS WAF, Akamai App & API Protector
- Muse Glimmer 30B: Akamai App & API Protector, Imperva Cloud WAF; alternatives Cloudflare WAF

## Sources the answers cite

72 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- imperva.com: 43 answers, 80 citations
- cloudflare.com: 32 answers, 60 citations
- akamai.com: 22 answers, 37 citations
- developers.cloudflare.com: 21 answers, 31 citations
- checkpoint.com: 21 answers, 27 citations
- radware.com: 20 answers, 24 citations
- geekflare.com: 20 answers, 20 citations
- openappsec.io: 19 answers, 21 citations

Pages named in the most answers:

- https://geekflare.com/guides/best-web-application-firewall (20 answers)
- https://cloudflare.com/products/waf (18 answers)
- https://expertinsights.com/network-security/the-top-web-application-firewalls (18 answers)
- https://imperva.com/products/web-application-firewall-waf (18 answers)
- https://checkpoint.com/cyber-hub/cloud-security/what-is-web-application-firewall/the-top-5-waf-providers (16 answers)
- https://gane.ai/index/it/network/web-application-firewalls/enterprise (15 answers)
- https://imperva.com/blog/best-waap-solutions (15 answers)
- https://openappsec.io/post/best-waf-solutions-in-2024-2025-real-world-comparison (15 answers)
- https://edgeone.ai/blog/details/best-waf-providers (14 answers)
- https://ciopages.com/buyer-guides/web-application-firewall (13 answers)

## Warned against

- AWS WAF: 24 of 55 labels negative. "A large enterprise should primarily avoid the financial risks associated with usage-based cloud-native WAFs (AWS/Azure/Fastly)" (Qwen 3.7 Flash, negative prompt)
- Azure WAF: 14 of 24 labels negative. "What to Avoid If Predictable Cost Is Your Priority ... Public Cloud WAFs (AWS WAF, Azure WAF, Google Cloud Armor)" (Gemini 3.5 Flash, budget prompt)
- F5 BIG-IP Advanced WAF: 9 of 31 labels negative. "Older on-premises or appliance-based solutions from vendors like F5 (e.g., older BIG-IP ASM versions)... Why avoid or be cautious" (Grok 4.20, negative prompt)
- Imperva Cloud WAF: 8 of 66 labels negative. "Imperva (legacy deployments)... Why avoid or be cautious" (Grok 4.20, negative prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Cloudflare WAF at 60%.

- Akamai App & API Protector: 16% to 8%, −8. Inside the floor by 3 points · rank 2 → 3 of 72.
- Imperva Cloud WAF: 12% to 19%, +7. Inside the floor by 4 points · rank 3 → 2 of 72.
- Fastly Next-Gen WAF: 4% to 0%, −4. Inside the floor by 7 points · rank 5 → 10 of 72.
- F5 BIG-IP Advanced WAF: 4% to 0%, −4. Inside the floor by 7 points · rank 4 → 13 of 72.
- AWS WAF: 2% to 0%, −2. Inside the floor by 9 points · rank 6 → 52 of 72.
- Cloudflare WAF: 59% to 60%, +1. Inside the floor by 10 points · rank 1 of 72, unchanged.
- Fortinet FortiWeb: 0% to 0%, ±0. Inside the floor by 11 points · rank 10 → 11 of 72.
- Radware Cloud WAF: 0% to 0%, ±0. Inside the floor by 11 points · rank 11 → 12 of 72.
- Azure WAF: 0% to 0%, ±0. Inside the floor by 11 points · rank 84 → 72 of 72.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.