Since ours is a business SaaS application that will be utilized by other companies, I believe there may also be commercial benefits of having a WAF. Eventually, we may need to do a formal security audit and penetration testing but it seems to me it would help to tell customers that we are using a WAF as part of our infrastructure. Is that possible?