WAF deployment
We design, roll out and tune a web application firewall in front of your applications, so it stops attacks without blocking your real customers.
Who it is for
- Your applications face the internet with no WAF, or one that only logs.
- A customer or your regulator expects one.
- You turned a WAF on once and it blocked real users.
What you get
- A WAF design for your applications and provider, such as AWS WAF, Cloudflare or Azure Front Door
- Rules tuned to your traffic, with every exception written down
- Alerts and dashboards your team can read
- A runbook for handling a block or a false positive
How it runs
Design
We choose rule sets and where the WAF sits, and agree what must never be blocked.
Watch
The WAF runs in log-only mode first, so we can see what it would block.
Tune
We adjust the rules against your real traffic until false positives are rare.
Enforce
We switch to blocking in stages, with a quick way to roll back.
- Typical length
- Two to four weeks, most of it watching real traffic. Lengths are typical. We confirm them when we agree the scope.
- What we need from you
- Access to your DNS or CDN and cloud accounts, and a developer who knows the applications.
Frameworks it helps with
- ISO/IEC 27001
- SOC 2
- RBI NBFC cyber directions
A tuned WAF with logs and a runbook is evidence of application protection that an auditor can check.
Related services
DevSecOps
Security checks built into your pipelines: dependency and secret scanning, infrastructure-as-code review and release gates sized to how your team ships.
Zero trust architecture advisory
A staged roadmap from network-based trust to access decided by identity, device and context, planned at a pace your team can deliver.
Security architecture review
A review of how your systems are built: trust boundaries, identity, data flows and the controls between them.