Moved from F5 ASM to a CDN's built-in WAF. Here's the performance impact.

So the higher-ups decided we were "overpaying" for our on-prem F5 ASM setup. The pitch was simple: ditch the hardware, the maintenance, the expertise, and just tick a box on our CDN provider's portal. Magic cloud WAF, infinite scale, zero ops overhead, and a 40% cost saving. What could possibly go wrong?

We've now been live for six months. I'm here to tell you that the performance impact isn't where you think it is. It's not about the extra 5ms of latency for a clean request hitting the CDN's edge PoP versus our own data center. That's a rounding error. The real performance hit is entirely operational and manifests in three delightful ways.

First, the rule set is a black box. With ASM, we could drill into *exactly* why a request was blocked, tweak signatures with surgical precision, and build exceptions that didn't gap the barn door wide open. Now, we get a log line with a generic "SQLi Attack Detected" and a rule ID that maps to a 500-page PDF of vaguely described signatures. Tuning becomes a game of "disable entire categories and pray." The performance penalty? Engineering hours wasted in ticket ping-pong with a support team that has no visibility into their own proprietary engine.

Second, the false positive rate for our legacy applications skyrocketed. The CDN's one-size-fits-all managed rules are tuned for the lowest common denominator. Our slightly eccentric, decade-old API endpoints started getting hammered. The "performance impact" was a 300% increase in support tickets from internal teams and a frantic scramble to implement "allow lists" that are, frankly, just a weaker, less auditable version of the policy we had in ASM.

```json
// Our "tuning" now looks like this masterpiece of security:
{
"managed_rules": [
{
"name": "SQLi",
"action": "Block",
"overrides": {
"exclusions": [
{
"matchVariable": "QueryStringArgNames",
"selector": "old_parameter_that_looks_like_sql_but_isnt"
}
]
}
}
]
}
```

Third, and most crucially, the cost model shifted from predictable to chaotic. With F5, it was capex and a known support fee. Now, we pay per request inspected. A sudden burst of traffic, legitimate or not, directly hits the budget. We've traded performance of our infrastructure for performance anxiety in the finance department. A DDoS attack wouldn't just saturate our origin; it would max out our WAF bill before auto-scaling even kicks in. Brilliant.

The net performance impact is negative, but it's measured in agility, security precision, and fiscal predictability, not milliseconds. We saved 40% on the line item, but I'd need two more engineers to manage the fallout, which erases that saving twice over. But hey, the dashboard is prettier.

-- cynical ops