Service · 2–4 weeks · Fixed fee
Find out what your WAF really stops, and what slips past it
I review your WAF, WAAP, bot and API controls against your real estate and traffic, then show the gaps, the bypass paths and a safe route to blocking.
- 2–4 weeks
- Fixed fee
- OWASP Top 10
- OWASP API Security Top 10 (2023)
- OWASP Automated Threats to Web Applications
In short
A WAAP (web application and API protection) assessment is an independent review of the controls in front of your web applications and APIs (application programming interfaces): the WAF (web application firewall) or WAAP platform, bot management and API security. I measure coverage across the estate, check blocking mode and tuning, test for origin bypass, and deliver a prioritised tuning or migration plan.
This is for you if
- The WAF went live years ago and still runs mostly in monitor mode
- Nobody is sure which applications and APIs sit behind it
- Bots hit login, OTP or sign-up, and the fraud team feels it
- A move from an on-premises WAF to cloud WAAP is on the table
When to call me
The moments this engagement is built for.
- 01A licence renewal is dueBefore you renew or switch platforms, you want proof of what the current one covers and actually blocks.
- 02A bot or credential stuffing waveLogin and OTP traffic spiked, messaging costs jumped, and the WAF did not stop it.
- 03Planning a cloud WAAP migrationYou need an inventory, a wave plan and exit criteria for blocking before the first DNS change.
- 04An audit asks for WAF evidenceAuditors want coverage, blocking status and how exceptions are approved, not just a licence.
How it runs · 2–4 weeks
From kick-off to a plan you can act on.
- 01Inventory and access
- Reconcile DNS, certificates and WAF configuration
- List every app and API in front of and behind the edge
- 02Policy and bot review
- Check blocking mode, signatures and exceptions per app
- Review bot rules on login, OTP and sign-up flows
- Compare discovered APIs with documented ones
- 03Bypass and origin testing
- Look for origins that answer without the WAAP
- Run safe tests of OWASP Top 10 attack classes
- 04Plan and readout
- Rank gaps by exposure and business criticality
- Draft the tuning or migration wave plan
- Agree exit criteria for blocking with app owners
What you get
Deliverables, not a slide deck of opinions.
- SpreadsheetCoverage mapEvery application and API, whether it sits behind the edge, and its mode: off, monitor or block.
- PDF reportBypass and origin findingsOrigins reachable directly, stale DNS records and other routes an attacker could use to skip the WAAP.
- PDF reportPolicy and exception reviewSignatures switched off, exceptions scoped too widely and bot rules missing on critical flows.
- SpreadsheetAPI exposure listDiscovered endpoints compared with the documented inventory, with shadow and old versions flagged.
- SpreadsheetTuning or migration planA wave plan with exit criteria for blocking, rollback steps and an owner for every application.
What happens next
Afterwards, you can decide.
An assessment is only useful if it changes a decision. These are the ones this engagement is designed to unlock.
- 1Which applications move to blocking first, and on what exit criteria
- 2Whether to tune the current platform or migrate, based on evidence
- 3Which API flaws must be fixed in code because the edge cannot stop them
- 4Who runs the tuning: your team, a partner or Innov8’s AppSec unit
- 01
Assess
I audit your applications and the security you already have, across six areas. Evidence, not questionnaires.
- Findings with evidence
- Score per area
1–4 weeks
- 02
Recommend
A prioritised plan: what to fix first, what it costs, and what risk it removes.
- 30/90/365-day plan
- Board summary
With the assessment
- 03
Execute, case by case
If you want help delivering, I scope it by expertise, manpower and timeline. Your team, a partner or Innov8.
- Delivery options
- Independent oversight
Only where it makes sense
Method
Built on standards your auditors recognise.
- OWASP Top 10
- OWASP API Security Top 10 (2023)
- OWASP Automated Threats to Web Applications
Grounded in delivery
Where this experience comes from.
- 112applications migrated112 bank applications moved to cloud WAAP, wave by waveBanking · A leading Sri Lankan private bankF5 Distributed CloudRead the case
- 120applications protectedAround 120 applications under WAAP, API and bot protectionManufacturing · A global apparel group headquartered in Sri LankaImpervaRead the case
- SIEMtelemetry pipelineWAAP security events arriving in the bank’s SIEM, reliablyBanking · A leading Sri Lankan private bankF5 → Logstash → Trellix SIEMRead the case
What is the difference between a WAF and a WAAP?
A WAF (web application firewall) inspects web traffic and blocks attack patterns such as SQL injection. A WAAP (web application and API protection) platform adds discovery and schema enforcement for APIs (application programming interfaces), bot management and usually DDoS (distributed denial-of-service) protection, normally from a cloud edge. Many organisations own WAAP features they have never switched on, which is one of the first things I check.
Is a WAF in monitor-only mode doing anything?
It records attacks but stops none of them. Monitor mode is the right way to start, because it shows real traffic before you block, but many deployments never leave it. I check each application’s mode, review what the logs say it would have blocked, and set exit criteria per application so blocking can be switched on without breaking legitimate users.
Should we move from an on-premises WAF to a cloud WAAP?
Sometimes, but not by default. A cloud WAAP (web application and API protection) platform adds edge capacity, discovery of APIs (application programming interfaces) and bot management, and removes appliance upkeep. It also changes TLS (Transport Layer Security) termination, DNS (Domain Name System) and where logs are stored. I compare what your current platform could do if tuned properly with what a migration would add, so the decision rests on evidence.
Will the assessment disrupt production traffic?
No. Configuration and log review are read-only. Bypass testing is limited to safe checks, such as whether an origin answers directly or a stale DNS (Domain Name System) record still points at it, and runs only in a window you approve. I do not run load or denial-of-service tests against production, and the SOC (security operations centre) is told before any active test.
Do you only assess F5 and Imperva platforms?
No. Ravindu Fernando, a Colombo-based application security consultant, has onboarded more than 230 applications to F5 Distributed Cloud and Imperva across two programmes, so he knows both well. The assessment checks outcomes that apply to any WAF (web application firewall) or cloud edge platform: coverage, blocking mode, exception hygiene, origin protection, bot controls on critical flows and logging. Recommendations stay vendor-neutral.
Other engagements
- AppSec maturity assessmentScored baseline, gap analysis, 12–24 month roadmap, board summary
- Application architecture reviewThreat model, control coverage map, prioritised fixes
- Mobile app security assessmentMobile threat model, protection policy, MASVS test plan
- Exposure management (CTEM) assessmentPrioritisation model, validation approach, owner playbook, metrics
- Executive briefing or team workshopPlain-language risk briefing or hands-on workshop
- Fractional AppSec advisorRoadmap governance, vendor and design reviews, escalation support