# Web application firewalls for small business buyers: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "web application firewall" and as "WAF and bot protection service", six framings each, to fourteen models with search on, on behalf of a small B2B company. Page: https://www.gane.ai/index/it/network/web-application-firewalls/smb

**Standing:** Cloudflare WAF leads with 94% of first choices; verdict consensus. 49 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Cloudflare WAF](https://www.gane.ai/index/it/vendors/cloudflare-waf/index.md) | 94% | 9% | 79 |
| 2 | [Sucuri WAF](https://www.gane.ai/index/it/vendors/sucuri-waf/index.md) | 2% | 12% | 51 |
| 5 | [AWS WAF](https://www.gane.ai/index/it/vendors/aws-waf/index.md) | 0% | 14% | 58 |
| 6 | [Azure WAF](https://www.gane.ai/index/it/vendors/azure-waf/index.md) | 0% | 11% | 19 |
| 7 | [Fastly Next-Gen WAF](https://www.gane.ai/index/it/vendors/fastly-next-gen-waf/index.md) | 0% | 26% | 19 |
| 71 | [ModSecurity](https://www.gane.ai/index/it/vendors/modsecurity/index.md) | 0% | 50% | 18 |
| 77 | [Akamai App & API Protector](https://www.gane.ai/index/it/vendors/akamai-app-api-protector/index.md) | 0% | 71% | 14 |
| 79 | [F5 BIG-IP Advanced WAF](https://www.gane.ai/index/it/vendors/f5-big-ip-advanced-waf/index.md) | 0% | 90% | 10 |
| 80 | [Imperva Cloud WAF](https://www.gane.ai/index/it/vendors/imperva-cloud-waf/index.md) | 0% | 64% | 33 |

Rank is by share of first choices among all 80 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Cloudflare WAF; alternatives Azure WAF, Barracuda Web Application Firewall, Sucuri WAF
- GPT-5.4 mini: Cloudflare WAF; alternatives AWS WAF, Azure WAF
- Gemini 3.5 Flash: Cloudflare WAF; alternatives AWS WAF, Fastly Next-Gen WAF, Imperva Cloud WAF
- Perplexity Sonar: Cloudflare WAF; alternatives AWS WAF, Sucuri WAF
- Grok 4.20: Cloudflare WAF; alternatives AWS WAF, Fastly Next-Gen WAF, Imperva Cloud WAF, Indusface AppTrana
- Mistral Small: Cloudflare WAF; alternatives AWS WAF
- DeepSeek V4 Flash: Cloudflare WAF; alternatives AWS WAF, Sucuri WAF
- Llama 4 Maverick: Cloudflare WAF
- Qwen 3.7 Flash: Cloudflare WAF; alternatives Azure WAF, Sucuri WAF
- Kimi K2: Cloudflare WAF; alternatives AWS WAF, Sucuri WAF
- GLM 4.7 FlashX: Cloudflare WAF; alternatives AWS WAF, Imperva Cloud WAF, Sucuri WAF
- MiniMax M2.5: Cloudflare WAF; alternatives AWS WAF, Azure WAF, Sucuri WAF
- GPT-6 Luna: Cloudflare WAF; alternatives AWS WAF
- Muse Glimmer 30B: Cloudflare WAF; alternatives AWS WAF, Sucuri WAF

## Sources the answers cite

71 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- g2.com: 41 answers, 52 citations
- geekflare.com: 33 answers, 33 citations
- cloudflare.com: 28 answers, 52 citations
- wafplanet.com: 27 answers, 33 citations
- spotsaas.com: 20 answers, 21 citations
- developers.cloudflare.com: 19 answers, 34 citations
- gane.ai/index: 19 answers, 19 citations
- imperva.com: 17 answers, 22 citations

Pages named in the most answers:

- https://g2.com/categories/web-application-firewall-waf/small-business (37 answers)
- https://geekflare.com/guides/best-web-application-firewall (33 answers)
- https://gane.ai/index/it/network/web-application-firewalls/smb (19 answers)
- https://spotsaas.com/list/web-application-firewall--waf--software/for-small-business (18 answers)
- https://cloudflare.com/products/waf (16 answers)
- https://softwaretestinghelp.com/web-application-firewall-waf (16 answers)
- https://wafplanet.com/best-waf-for/small-business (16 answers)
- https://mgsoftware.nl/en/tools/best-web-application-firewalls (14 answers)
- https://cloudflare.com/en-gb/application-services/products/waf (13 answers)
- https://bleepingcomputer.com/sysadmin/guides/best-web-application-firewalls (11 answers)

## Warned against

- Imperva Cloud WAF: 21 of 33 labels negative. "Weaknesses: Expensive, especially for small businesses. Complex configuration may require specialized technical personnel." (Muse Glimmer 30B, negative prompt)
- AWS WAF: 8 of 58 labels negative. "the pricing structure includes components like Web ACL, Rule, Bot control, and Fraud Control, which requires paying part by part and can be annoying for small businesses" (Claude Haiku 4.5, negative prompt)
- Akamai App & API Protector: 10 of 14 labels negative. "criticized or have low adoption rates in recent comparisons, suggesting they may not be the best fit" (Mistral Small, negative prompt)
- ModSecurity: 9 of 18 labels negative. "Why cautious/avoid: It's free but demands significant security expertise to configure, tune rules, and maintain." (Grok 4.20, negative prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Cloudflare WAF at 94%.

- Cloudflare WAF: 79% to 94%, +15. Cleared the floor by 4 points · rank 1 of 80, unchanged.
- Sucuri WAF: 11% to 2%, −9. Inside the floor by 2 points · rank 2 of 80, unchanged.
- AWS WAF: 2% to 0%, −2. Inside the floor by 9 points · rank 3 → 5 of 80.
- Indusface AppTrana: 2% to 0%, −2. Inside the floor by 9 points · rank 4 → 37 of 80.
- Akamai App & API Protector: 2% to 0%, −2. Inside the floor by 9 points · rank 7 → 77 of 80.
- Imperva Cloud WAF: 2% to 0%, −2. Inside the floor by 9 points · rank 8 → 80 of 80.
- Azure WAF: 0% to 0%, ±0. Inside the floor by 11 points · rank 9 → 6 of 80.
- Fastly Next-Gen WAF: 0% to 0%, ±0. Inside the floor by 11 points · rank 21 → 7 of 80.
- ModSecurity: 0% to 0%, ±0. Inside the floor by 11 points · rank 75 → 71 of 80.
- F5 BIG-IP Advanced WAF: 0% to 0%, ±0. Inside the floor by 11 points · rank 70 → 79 of 80.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.