A WAF Is Not a Patch
- 1371 words
- 7 min read
A web application firewall buys you time and visibility, but it does not remove the vulnerability. What a WAF and virtual patching can and cannot do, and what engineering teams still owe.
A web application firewall buys you time and visibility, but it does not remove the vulnerability. What a WAF and virtual patching can and cannot do, and what engineering teams still owe.
Jev, Laya, and Liquid d1 can share a request shape without sharing an error profile. Changing the model means revalidating the thresholds, review workload, and deployment behind the application's policy.
GPT-6 Astra is offered as a model that acts inside existing software. The scores I would read first are the ones that show where it stays inside the task, and where it does not win.
Anthropic says Opus 5.5 is at Fable 5.1's level on most work and 40 percent cheaper than Opus 5 at default settings; the useful question is what that does to the cost and the checks of an agent loop.
A typed AI judgment can help software route work, provided the application owns the rules, checks uncertainty, and keeps people responsible for consequential decisions.
AI-assisted work becomes more useful when teams turn repeated discoveries, corrections, and failures into better shared context, checks, and workflows.
Instead of reviewing every line an AI agent produces, design the environment — specs, tests, checks, and feedback loops — so good outcomes emerge reliably.
Good architecture often starts with understanding the system you already have; how requests flow, where dependencies are, and why things ended up the way they are.