WAFs have two primary states of being: the state known as blocking mode, wherein their focus is on stopping suspicious traffic before it gets onto the site, and the state known as monitor only, which means logging suspicious activity but not actually acting upon it.
The idea that an enterprise would willingly switch over to monitor only seems kind of unbelievable. After all, if you have two options – actually stop a crime from happening, or just write down the details as you see them without doing anything – it’s obvious what any level-headed person would choose to do. Who wants to be told about all the accidents that could have been prevented, but weren’t?
But it’s not as simple as that. For a lot of enterprises – and, arguably, now more than ever before – there’s a real fear of blocking legitimate, human users (and, more recently, legitimate AI agents) in the fight to stop bots. For them, the trade-off kind of makes sense. Increased risk of scraping and negative activity, but decreased risk of losing actual human customers in one of the most frustrating and alienating ways imaginable: telling them they’re an unwelcome bot.
It’s not a split second decision, either. Enterprises tend to drift gradually over to the side of monitoring in response to too many false positives. Teams not working in network edge security tend to pushback pretty hard against false positives. Over time, security teams have to ‘soften the edges’, create exceptions and ‘bend’ points in the rules to reduce the risk of blocking customers.
In the meantime, the vulnerabilities this creates tend to remain invisible until an attack actually happens. So, in a situation where false positives are immediately, negatively visible but the downsides to softening limitations aren’t, it’s understandable how so many enterprises end up in this situation, despite it looking so counterintuitive from the outside. It’s not the case that the moment a team carves exceptions into the WAF, the entire narrative flips from ‘we do it this way’ to ‘we do it that way’. It’s a slow rot, and every day makes the system more vulnerable.
The trouble is, exploitation is happening faster than most teams can review a log alert. Before they can even think of formulating a response. The situation is getting worse as AI tools make attacks run on an accelerated timeline, eschewing human touch points between each step and fully automating a highly sophisticated attack the moment a vulnerability is identified. The only way to fight this is by creating rigid rules that actively block traffic that breaks them, rather than sticking with the old method of reviewing suspicious activity via the logbook when it’s already made its way through.
WAFs in monitor mode offer too much of a sense of security and make teams complacent when there’s no one standing at the door, turning away threats.
Continuous visibility, application context integrated into policy decisions, and a continuous cycle of orchestrating vital changes safely are the only way to keep an enterprise secure. Anything else is misguided or outdated.
