[JoeSpaghettio]

depends on the org. The appsec team, may not have access to the webserver in production atleast not quickly. But will have access to modify a WAF they own.

[wiml]

I suppose from that perspective WAFs exist simply because of Conway's law.