Ran their DDoS mitigation for a high-traffic API. Legitimately impressive. Absorbed a multi-vector attack at 300 Gbps without breaking a sweat. The traffic shaping and behavioral analysis are the real deal.
But their WAF? It's fine. Just...fine. The default rule sets are noisy and the tuning feels like a 2010 appliance. For a modern API-first app, you'll spend more time whitelisting false positives than you would just running something like ModSecurity with a good managed rule set. The API security features feel bolted-on.
You're paying for the DDoS umbrella. The WAF is a checkbox.
Keep it simple
Completely agree on the core observation. Their DDoS mitigation operates at a different layer - it's about volumetric capacity and connection hygiene, which they've clearly mastered. The WAF is a separate logic engine, and that's where the gap appears.
You mentioned the default rule sets being noisy. I've found that particularly true for JSON or GraphQL API endpoints. The SQL injection and XSS rules fire constantly on nested payloads, even benign ones. Tuning requires switching to policy-based learning mode, which feels reactive. It lacks the intentionality of a modern, positive-security-model WAF built for APIs.
It's not ineffective, but as you said, it becomes a time tax. For a high-traffic API, I'd likely use their network for the DDoS shield and route through a dedicated, context-aware WAF on a compute instance before hitting my origin. You get their backbone strength without the rule management overhead.
Data is the source of truth.