Dr. Chase Cunningham Critiques Web Application Firewalls and Their Effectiveness
- Securityish
- Tools & Best Practices
Quick Summary
Dr. Chase Cunningham from Ericom Software argues that web application firewalls (WAFs) are ineffective against modern attacks. His insights reveal that over 86% of organizations experienced application-layer attacks that bypassed their WAFs in the past year. Additionally, managing WAF deployments requires significant resources, averaging $620K annually, which raises concerns about their overall value in cybersecurity strategies.
The Securityish Brief
Dr. Chase Cunningham’s recent commentary on LinkedIn highlights significant shortcomings of web application firewalls (WAFs). He emphasizes that WAFs, which are traditionally designed to block attacks based on traffic patterns, are not aligned with contemporary security needs. According to research conducted by Ponemon, while 66% of organizations view WAFs as important, over 40% only use them for alert generation rather than blocking attacks.
Furthermore, the Ponemon study revealed that 86% of organizations faced application-layer attacks that successfully bypassed their WAFs in the last year. The complexity of managing WAFs is also a concern, requiring an average of 2.5 security administrators who spend considerable time addressing alerts and writing new rules. This management burden, combined with an annual cost of $620K, raises questions about the effectiveness of WAFs as a security measure.
Implications for Cybersecurity Practices
The critique of WAFs underscores a broader shift towards Zero Trust security models, which prioritize continuous verification over perimeter-based defenses. Organizations should consider whether their reliance on WAFs is justified, especially given the high rate of bypassed attacks. This situation calls for a reassessment of security strategies, particularly for those managing public-facing applications.
As application programming interfaces (APIs) become increasingly targeted, organizations must ensure that their applications have robust security configurations. This includes defining authorization options for various API routes and methods. By doing so, organizations can better protect themselves against the evolving landscape of cyber threats.
In light of these insights, businesses should explore alternative security measures, such as Web Application Isolation (WAI), which emphasizes secure authentication and controlled access. This approach may provide a more effective defense against modern cyber threats.
Key Takeaways
- Evaluate the effectiveness of your current WAF solution and consider its limitations in blocking modern attacks.
- Assess the resources allocated to managing your WAF and determine if they could be better utilized elsewhere.
- Implement robust security configurations for APIs to protect against potential vulnerabilities.
- Explore alternative security models, such as Web Application Isolation, to enhance your cybersecurity posture.
- Stay informed about the latest trends in cybersecurity to adapt your strategies accordingly.
Key Terms & Concepts
- Web Application Firewall (WAF): In this article, a WAF refers to a security tool designed to monitor and filter HTTP traffic to and from a web application.
- Zero Trust: In this article, Zero Trust refers to a security model that requires strict identity verification for every person and device trying to access resources.
- Ponemon Institute: In this article, Ponemon Institute is referenced as a research organization that conducts studies on data security and privacy.
Read the original article here: https://securityboulevard.com/2025/12/the-waf-must-die-some-interesting-thoughts-firetail-blog/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
