A web application firewall helps identify and block selected malicious requests while applications are running. It does not establish that the underlying application is secure.
Use secure development practices, software-component visibility and authorized dynamic testing alongside appropriate web protection.
The OWASP Top 10:2025 is a useful current awareness reference for discussing application weaknesses.
Key takeaways
- WAF and bot defenses inspect traffic.
- Source, dependency and dynamic testing investigate different weaknesses.
- Use layered controls and verify that remediation actually changes exposure.
Primary sources and further reading
Sources are published by the organizations named below. The guidance in this article is our explanation of those sources, not a claim of independent empirical research.
Different layers address different attack paths
A web application firewall inspects and may filter requests reaching a protected application. This is useful for traffic-based controls, but it cannot establish that application logic, dependencies, secret management, or access controls are well designed. Conversely, code analysis cannot replace runtime traffic protection against abusive requests.
Build security into the development lifecycle
Source-code analysis can flag patterns that warrant review. Dependency analysis helps teams identify known component risk, while testing deployed applications can reveal behavior that source review does not expose. API security adds questions about authorization, schema validation, rate controls, and how unexpected inputs are handled.
False positives and coverage gaps are normal considerations in testing. A finding should be reviewed in context, assigned to an owner, and checked again after remediation. The goal is to reduce exploitable exposure, not simply maximize the number of scanner alerts.
Practical review questions
- Which websites and APIs are actually in scope and publicly reachable?
- Are privileged functions and object-level authorization tested?
- Who is responsible for reviewing scanner findings and validating fixes?
- Does traffic protection complement, rather than replace, secure development?
OWASP's application-security guidance provides a useful starting point for prioritizing these decisions.
Continue with primary guidance
The overview above is educational; requirements and technical details should be reviewed against the underlying source and your actual environment.