Making WAF Mainstream: From Static Defenses to... (Roy Weisfeld, Surya Pentakota)
summary
Shows a working edge security platform that layers AI over CDNs and WAFs to auto-enrich logs, backtest rules in log-only mode, and generate targeted remediations that deploy across providers. Claims a TikTok-scale case study where detection to enforced mitigation completes in 12 minutes and multi-CDN policy rollout shrinks from ~30 minutes to under 3 minutes. Describes agentic flows that synthesize business context, run past-traffic simulations, reduce false positives, translate vendor rules for migration, and handle fleets with tens of thousands of rules.
AI-written summary · about
chapters (20)
- 0:00Introduction and speakers
- 1:27Why WAF frustrates everyone
- 4:37Engineers' pain points with WAF
- 7:27Executives' frustration with WAF
- 9:53Current WAF chaos and limitations
- 11:17Edge security layer concept
- 13:22Why AI matters in WAF
- 16:07TikTok case study overview
- 17:11TikTok's WAF challenges
- 18:35Solutions with unified framework
- 21:04Real-world attack timeline
- 23:09AI as a force multiplier
- 24:12Framework for any company
- 24:54Intelligence architecture breakdown
- 29:03Real examples of unified framework
- 32:53Vendor lock-in problem
- 34:58Key takeaways for engineers
- 35:40Key takeaways for CISOs
- 36:24Key takeaways for infrastructure heads
- 37:27Q&A session
related talks
40mWAF Made Easy
46mIt is rough without a WAF
38mWeb Application Firewalls Revisited
15mLevel up security: Advanced AWS WAF rules & bot detection techniques
27mSecuring Applications and Managing WAFs at a large scale
42mDon’t use a WAF, and when you should, anyway.
14mWeb Application Firewalls: A False Sense of Security?
33mWAFs FTW! A modern devops approach to security testing your WAF