But mod_security provide a very basic approach based on signatures (regular expressions) which: - very hard to maintain and tune, especially if you have applications with a lot of updates (if you don't tune you'll get false-positives); - they don't cover all the attacks; - it not that fast because you need to match each request to the signature database (it's possible to make fast though as CloudFlare did with LuaJIT and OpenResty).
There are no learning capabilities in mod_security, so you need to dedicate engineers time to tune it. There is a lack of analytics. It will detect thousands and millions of malicious request but never says which of them are targeting real vulnerabilities in your apps.
Anyway, mod_security is just another product. It's plain WAF, with a great community and good CRS (signature ruleset).
Feel free to shoot me a note at [email protected]
"Detect anomalies and block attacks with no latency" seems hard to believe - minimal latency, maybe, but none?
On the other hand, good luck to Wallarm - there need to be better WAFs out there.