Given this challenge, what should security professionals do? What will prevent web applications from becoming the front door into an organization’s infrastructure? Knowing that DevOps are going to keep spinning out new code, how can one figure out if their WAF is worth the maintenance or dead in the water?