Has anyone successfully used Radware to protect a GraphQL API?

Hey everyone,

I'm in the middle of a quarterly app security audit and we're evaluating our WAF capabilities. We have a few critical internal and partner-facing services built with GraphQL, and I'm trying to map our coverage.

I know Radware is a solid player for traditional REST API protection, but GraphQL's single endpoint and query-based structure can be a different beast. I'm looking for real-world experience.

Has anyone here deployed Radware (on-prem or cloud WAF) specifically to secure a GraphQL API? I'm particularly curious about:

* **Policy configuration:** Did you use out-of-the-box GraphQL protections, or did you have to build custom signatures/rules? How was the learning curve?
* **False positives:** Did you run into issues with legitimate, complex nested queries getting blocked? How fine-grained were the tuning knobs?
* **Visibility:** Did the reporting give you clear insights into malicious queries or attempted data exfiltration attacks (like deep nested queries)?
* **Performance impact:** Any noticeable latency added on the query parsing and inspection layer?

We're also looking at this from a SaaS rationalization angle—if it requires a ton of custom work, we might need to factor that into the true cost of ownership versus a more niche tool.

Any lessons learned, config snippets you're willing to share, or even "watch out for X" would be super helpful for my audit report.

audit often