3 questions from the package
From the RFI round. The first shows part of the guide each question carries; the workbook adds follow-ups, how to verify the answer, a priority and a weight.
1. Provide a mapping of each of these attack classes to the managed rule group that detects it by default: SQL injection, cross-site scripting, server-side request forgery, insecure deserialization, path traversal, OS command injection, and local or remote file inclusion.
Why it matters. If an attack class has no default rule group, the buyer must write and maintain custom rules for it or leave that class undetected.
Good answer
- Each listed attack class maps to a named rule group or rule ID range
- States which rule groups are enabled by default and which must be turned on
- Notes platform-specific variants covered, such as Java deserialization or PHP object injection
Red flags
- A general claim of coverage with no rule group names
- Some classes are covered only by an optional rule package, and the answer does not say which
- Server-side request forgery or deserialization is left to custom rules the buyer writes
2. Can each managed rule be set to log only while the other rules in its rule group continue to block?
Why it matters. If log-only can be set only for a whole rule group or a whole policy, one noisy rule forces the buyer to stop blocking every attack class in that group. That stalls the move from monitoring to blocking.
3. List the request attributes that a custom rule written by our operators can match on to block exploitation of a specific vulnerability, such as hostname, path, HTTP method, header, cookie, query parameter and a named field inside a JSON or XML body.
Why it matters. If custom rules cannot reach the field where an exploit payload sits, the buyer cannot patch a vulnerability the vendor has not yet covered. The buyer must then wait for a managed rule or take the application offline.
Capability areas
Detection Engine & Managed Rule Sets (12)
How the product detects web attacks: managed rule coverage for the OWASP Top 10 attack classes, evasion and encoding handling, request-body parsing limits, and anomaly or ML scoring alongside signatures. Excludes API-specific enforcement and bot detection, which have their own areas.
False-Positive Control & Tuning (12)
Moving from monitoring to full blocking without breaking legitimate traffic: per-app baselining, exception scoping by path, parameter and rule, auto-tuning suggestions, paranoia or sensitivity levels, and the day-two triage workflow. Excludes how rule changes are versioned and deployed, which belongs to PAC.
Virtual Patching & Threat Research (9)
How the vendor responds to newly disclosed vulnerabilities: rule release process for new CVEs, emergency rule notification, customer-authored virtual patches, and how vendor rule updates are staged so they do not cause new false positives. Excludes general managed-rule coverage, which belongs to DET.
API Discovery & Inventory (11)
Building and maintaining an inventory of APIs from observed traffic: shadow and deprecated endpoint detection, sensitive-data classification in API payloads, spec generation, and drift against documented specs. Excludes runtime blocking of API requests, which belongs to APE.
API Schema Enforcement & Protocol Coverage (11)
Runtime protection of APIs: positive-security enforcement from OpenAPI or GraphQL schemas, coverage for REST, GraphQL, gRPC and WebSocket traffic, object-level and function-level authorization abuse detection, and protection against OWASP API Security Top 10 risks. Excludes discovery and inventory, which belong to APD.
Bot Detection & Classification (12)
Identifying and classifying automated traffic: behavioral and ML scoring, client fingerprinting, JavaScript and challenge options, mobile SDK coverage, verified-good-bot handling, and allowlisting partner and internal automation. Excludes account-specific abuse outcomes, which belong to ATO.
Account Takeover & Business-Logic Abuse (10)
Defense of login, signup, checkout and payment flows: credential stuffing, leaked-credential checks, fake account creation, card testing, inventory hoarding and scraping of business data. Excludes generic bot classification, which belongs to BOT, and volumetric attacks, which belong to DDS.
DDoS Mitigation & Rate Limiting (10)
Network-layer and application-layer DDoS mitigation scope, automatic versus manual mitigation, rate-limiting keys and actions, and the behavior of protected apps during an active flood. Excludes contractual pricing for attack traffic, which belongs to the commercial module.
Deployment Topology & Traffic Handling (12)
How the WAF sits in the traffic path: edge proxy, cloud-native, origin appliance, container or ingress module, and hybrid models with one policy across them; TLS and mTLS termination, origin protection against bypass, added latency, and fail-open or fail-closed behavior. Excludes generic hosting regions and tenancy, which belong to the deployment-hosting module.
Client-Side & Payment Page Script Protection (8)
Inventory, authorization and change detection for scripts executing in users' browsers on payment and sensitive pages, including evidence for PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1, and Content Security Policy management. Excludes the vendor's own PCI DSS attestation, which belongs to the compliance-certifications module.
Policy as Code & Rule Change Management (10)
Managing WAF policy through an infrastructure-as-code provider or the management API, staging and testing rule changes before production, per-app policy inheritance, rollback of enforced rule sets, role scoping so an app team can change only its own exceptions, and an audit trail of who changed which rule. Excludes console SSO and MFA, which belong to the security and integration modules.
Security Event Logging, Investigation & SIEM Export (10)
Request-level logging detail, request ID tracing for blocked users, attack dashboards, payload redaction in logs, log delivery time and SIEM or SOAR export, and what the vendor's managed attack-response service does during an incident. Excludes the vendor's own internal audit logging, which belongs to the security module.
Questions about this package
How many Web Application Firewall (WAF) RFP questions are there?
127 solution questions in 12 capability areas: 29 for the RFI, 63 for the RFP and 35 deep-dive questions for the finalists. The workbook adds 90 due-diligence questions on security, integration, implementation and exit.
What comes with each question?
Why it matters, good-answer signals, red flags, follow-up questions, how to verify the answer (a demo step, a test or a document), and a suggested priority and weight for scoring.
Can I edit the questions?
Yes. The workbook is an ordinary Excel file. Change, add or remove questions, and change the weights; the scorecard recalculates.
Which license do I need?
The Enterprise License covers any number of evaluations inside one organization. The Consultancy License covers use with any number of clients. Neither allows reselling or republishing the questions.
