[jcims]

For me the main benefit of a WAF is that ability to rapidly respond to zero day/CVE.

A good set of filters deters casual abusers and can amplify the signal from a skilled attack, but ultimately they tend to fail.