# Web application firewalls: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "web application firewall" and as "WAF and bot protection service", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/network/web-application-firewalls

**Standing:** Cloudflare WAF leads with 85% of first choices; verdict clear leader. 46 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Cloudflare WAF](https://www.gane.ai/index/it/vendors/cloudflare-waf/index.md) | 85% | 6% | 70 |
| 2 | [Sucuri WAF](https://www.gane.ai/index/it/vendors/sucuri-waf/index.md) | 4% | 12% | 17 |
| 3 | [AWS WAF](https://www.gane.ai/index/it/vendors/aws-waf/index.md) | 2% | 11% | 56 |
| 4 | [Imperva Cloud WAF](https://www.gane.ai/index/it/vendors/imperva-cloud-waf/index.md) | 2% | 20% | 46 |
| 5 | [Barracuda WAF](https://www.gane.ai/index/it/vendors/barracuda-waf/index.md) | 2% | 0% | 10 |
| 7 | [ModSecurity](https://www.gane.ai/index/it/vendors/modsecurity/index.md) | 2% | 50% | 20 |
| 8 | [Fastly Next-Gen WAF](https://www.gane.ai/index/it/vendors/fastly-next-gen-waf/index.md) | 0% | 8% | 25 |
| 9 | [Akamai App & API Protector](https://www.gane.ai/index/it/vendors/akamai-app-api-protector/index.md) | 0% | 26% | 31 |
| 10 | [Fortinet FortiWeb](https://www.gane.ai/index/it/vendors/fortinet-fortiweb/index.md) | 0% | 12% | 17 |
| 11 | [Azure WAF](https://www.gane.ai/index/it/vendors/azure-waf/index.md) | 0% | 25% | 16 |
| 12 | [F5 BIG-IP Advanced WAF](https://www.gane.ai/index/it/vendors/f5-big-ip-advanced-waf/index.md) | 0% | 24% | 17 |
| 14 | [Radware Cloud WAF](https://www.gane.ai/index/it/vendors/radware-cloud-waf/index.md) | 0% | 18% | 11 |

Rank is by share of first choices among all 78 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Barracuda WAF; alternatives Cloudflare WAF, Microsoft Azure WAF
- GPT-5.4 mini: Cloudflare WAF; alternatives AWS WAF, F5 Distributed Cloud WAF, Fastly Next-Gen WAF
- Gemini 3.5 Flash: Cloudflare WAF; alternatives AWS WAF, Fastly Next-Gen WAF, Imperva App Protect
- Perplexity Sonar: Cloudflare WAF; alternatives AWS WAF, Barracuda WAF, Fastly Next-Gen WAF
- Grok 4.20: Cloudflare WAF; alternatives AWS WAF, Azure WAF, Barracuda WAF, Fastly Next-Gen WAF
- Mistral Small: Cloudflare WAF; alternatives AWS WAF, Imperva SecureSphere
- DeepSeek V4 Flash: Cloudflare WAF; alternatives AWS WAF, Barracuda WAF-as-a-Service, Imperva Application Security
- Llama 4 Maverick: Cloudflare WAF
- Qwen 3.7 Flash: Cloudflare WAF; alternatives AWS WAF, Azure Front Door, F5 Distributed Cloud WAF, Imperva Cloud WAF
- Kimi K2: Cloudflare WAF; alternatives AWS WAF, Imperva Cloud WAF
- GLM 4.7 FlashX: Cloudflare WAF; alternatives AWS WAF, Imperva Cloud WAF
- MiniMax M2.5: Cloudflare WAF; alternatives AWS WAF, Azure WAF, Fastly Next-Gen WAF, Fortinet FortiWeb
- GPT-6 Luna: Cloudflare WAF; alternatives AWS WAF
- Muse Glimmer 30B: Cloudflare WAF; alternatives AWS WAF, Barracuda Web Application Firewall

## Sources the answers cite

70 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- imperva.com: 30 answers, 53 citations
- openappsec.io: 22 answers, 29 citations
- geekflare.com: 21 answers, 21 citations
- cloudflare.com: 19 answers, 37 citations
- developers.cloudflare.com: 18 answers, 30 citations
- fastly.com: 18 answers, 22 citations
- wafplanet.com: 17 answers, 22 citations
- cybersecuritynews.com: 16 answers, 20 citations

Pages named in the most answers:

- https://geekflare.com/guides/best-web-application-firewall (21 answers)
- https://openappsec.io/post/best-waf-solutions-in-2024-2025-real-world-comparison (19 answers)
- https://checkpoint.com/cyber-hub/cloud-security/what-is-web-application-firewall/the-top-5-waf-providers (13 answers)
- https://cybersecuritynews.com/best-web-application-firewall-solutions (13 answers)
- https://expertinsights.com/network-security/the-top-web-application-firewalls (13 answers)
- https://wafplanet.com/ (13 answers)
- https://softwaretestinghelp.com/web-application-firewall-waf (11 answers)
- https://appsentinels.ai/blog/top-25-web-application-firewalls-wafs-and-best-alternatives-for-cloudflare (9 answers)
- https://cloudflare.com/products/waf (9 answers)
- https://fastly.com/blog/most-reliable-web-application-firewalls (9 answers)

## Warned against

- ModSecurity: 10 of 20 labels negative. "Do not install this unless you are prepared to spend weeks maintaining the OWASP Core Rule Set (CRS). An unpatched open-source WAF is often less secure" (Qwen 3.7 Flash, negative prompt)
- Imperva Cloud WAF: 9 of 46 labels negative. "Imperva SecureSphere due to the documented critical bypass CVEs." (DeepSeek V4 Flash, negative prompt)
- AWS WAF: 6 of 56 labels negative. "Out-of-the-box cloud WAF rules (e.g., basic default AWS WAF or Azure WAF rules) without fine-tuning either block legitimate traffic or miss application-specific flaws." (Gemini 3.5 Flash, negative prompt)
- Akamai App & API Protector: 8 of 31 labels negative. "Avoid enterprise solutions (Imperva, Akamai, F5)" (DeepSeek V4 Flash, budget prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Cloudflare WAF at 85%.

- Cloudflare WAF: 69% to 85%, +16. Cleared the floor by 5 points · rank 1 of 78, unchanged.
- ModSecurity: 8% to 2%, −6. Inside the floor by 5 points · rank 2 → 7 of 78.
- Sucuri WAF: 0% to 4%, +4. Inside the floor by 7 points · rank 15 → 2 of 78.
- AWS WAF: 4% to 2%, −2. Inside the floor by 9 points · rank 3 of 78, unchanged.
- Imperva Cloud WAF: 0% to 2%, +2. Inside the floor by 9 points · rank 12 → 4 of 78.
- Radware Cloud WAF: 2% to 0%, −2. Inside the floor by 9 points · rank 6 → 14 of 78.
- Barracuda WAF: 2% to 2%, ±0. Inside the floor by 11 points · rank 7 → 5 of 78.
- Fastly Next-Gen WAF: 0% to 0%, ±0. Inside the floor by 11 points · rank 13 → 8 of 78.
- Akamai App & API Protector: 0% to 0%, ±0. Inside the floor by 11 points · rank 14 → 9 of 78.
- Fortinet FortiWeb: 0% to 0%, ±0. Inside the floor by 11 points · rank 18 → 10 of 78.
- Azure WAF: 0% to 0%, ±0. Inside the floor by 11 points · rank 22 → 11 of 78.
- F5 BIG-IP Advanced WAF: 0% to 0%, ±0. Inside the floor by 11 points · rank 17 → 12 of 78.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.