For my team, the WAF wasn’t about protecting us but rather reducing the amount of junk we saw coming from the public internet to our service. We’d get lots of weird payloads that would cause Nginx or Rails to throw an error even though they weren’t causing any breaches.

The WAF took away at least 99% of our random nighttime pages from the bad payloads. Best investment we made for oncall quality of life.