WAFs perform excellently at reducing automated noise and enforcing rules at the edge, but as the sole control against patient attackers using valid credentials and legitimate traffic, their effectiveness is limited.