Fastly Next-Gen WAF

Name: Fastly Next-Gen WAF
Brand: Fastly
Rating: 4.8 (568 reviews)

Leader

Fastly’s edge cloud platform enables the best of the web to thrive, and helps you deliver better online experiences.

Est 2011|Valuation $2.9B|Raised $686.4M

LinkedIn 72K|Website|Web traffic 268K|FTEs 1,140|HQ San Francisco, California, US

MarketsWeb Application & API Protection (WAAP)Firewalls

Published Sep 26, 2026

01Common complaints

1. Transparent, self-serve pricing and quick onboarding are primary procurement requirements - If procurement requires published pricing and immediate self-service onboarding, providers with published tiers and self-serve options may be preferred. 2. WebSocket inspection at edge/cloud is a primary technical requirement - WebSocket inspection is supported with Core (on-prem) deployment; edge/cloud deployments do not support WebSocket inspection in vendor documentation. 3. The environment is single-cloud and deep native integration is a priority - For organizations fully committed to a single cloud provider, native WAF offerings may reduce integration overhead. 4. The primary objective is the lowest possible cost for simple sites - For basic web properties or small application footprints, lower-cost WAF/CDN bundles targeted at SMBs may be more cost-effective. 5. The buyer is seeking broad platform consolidation beyond WAAP - If the goal is to consolidate ZTNA/SASE, WAF, SWG, CASB, and other security functions with a single vendor, other suites may be more appropriate.

Deal disqualifiers (poor fit)

Small teams that require published, self-serve pricing and low minimum commitments
Architectures requiring WebSocket inspection at edge/cloud where Core deployment is not feasible
Organizations seeking an all-in-one security platform that combines WAAP, ZTNA/SASE, endpoint, and email security in a single console

Vendor-documented limitations

- False positives are possible; vendor documentation recommends an initial monitoring period before enabling blocking. - Custom application vulnerabilities may not be covered without appropriate rule or signal configuration. - The WAF inspects HTTP/HTTPS (L7) traffic and does not inspect lower-layer protocols such as raw TCP/UDP/ICMP. - WebSocket inspection is documented as available only for Core/on-prem deployments and not for Edge/Cloud WAF deployments. - No security product prevents all attacks; customers should maintain layered defenses.

Roadmap / changes (observable from public changelogs)

2025 updates indicate expanded API capabilities for Next-Gen WAF analytics/reporting/alerts, FIPS 140-3 compliance notes for the agent, and agent auto-update improvements including Windows support in a 2025 release.

02Why they buy

Unique selling points supported by product documentation and observable features

Multiple deployment options (edge, cloud-hosted, and on-prem/Core) accessible under a single product name and control experience.
Configurable data redaction and telemetry controls described in product legal and support documentation.
Ongoing investment in automation and APIs for analytics, reporting, and alerting.

Claims that require validation

Vendor statements regarding reduced tuning requirements and lower false positives should be validated in the buyer’s environment through pilots and staged rollouts.

03Field reports

Review platforms (Gartner Peer Insights, G2, TrustRadius)

Gartner Peer Insights, G2, and TrustRadius each host review pages for Fastly Next-Gen WAF. Access to full text on some platforms may require login or subscription; publicly visible snippets provide limited context.

Important limitation: Some review platforms restrict automated or full access to reviews. For procurement, buyers should manually review a representative set of reviews from multiple platforms.

Positive feedback themes (common themes in reviews and vendor materials)

1. Deployment flexibility and hybrid coverage: Vendor materials and reviews frequently note support for edge, cloud-hosted, and on-premises deployment models. 2. Operational usability and reduced tuning burden (vendor claim): Fastly’s materials state reduced tuning requirements; independent validation in the buyer’s environment is recommended. 3. Analyst recognition: Independent analyst reports and vendor-cited analyst excerpts note placements and strengths; the specifics should be reviewed in the original analyst reports.

Negative feedback themes (complaints and critical perspectives)

1. Price opacity and perceived cost: Community discussions and some reviews note that pricing is not public and may be perceived as expensive for some use cases. 2. Product tradeoffs vs. other platforms: Some users compare the product to alternative providers that offer more integrated security suites or different packaging models. 3. Anecdotal dissatisfaction: Community channels contain anecdotal negative experiences; such comments are context dependent and should be weighed alongside structured reviews.

Common decision factors cited by customers

Need for consistent WAAP across hybrid/on-prem and edge environments
Preference for the product’s signal-based approach to detection versus rule-heavy workflows
Existing investments in Fastly edge services and desire to consolidate vendor relationships

Common reasons for churn or avoidance

Cost considerations compared with lower-cost or hyperscaler alternatives
Preference for a fully integrated, broad security platform when consolidation is a priority
Specific feature requirements (for example, certain protocol inspection modes) that are constrained by deployment model

Vendor-commissioned Forrester Total Economic Impact (TEI) of Fastly Application Security Solutions

A Forrester TEI study commissioned by the vendor models a composite organization deploying Next-Gen WAF plus Bot, API Security, and DDoS protection, and references sample initial licensing costs for the modeled environment.

Critical evaluation: Vendor-sponsored TEI studies can be useful for framing cost categories and potential benefit areas, but ROI outcomes and assumptions should be validated against the specific operational environment.

Vendor threat report and telemetry claims

Vendor threat reports provide metrics on the scope of telemetry and the composition of aggregated threat intelligence. These vendor-published metrics are useful for understanding the vendor’s data footprint but should be reviewed with attention to methodology and context.

04Best fit

Company sizes

Typical fit: mid-market and enterprise organizations (typically larger organizations), especially those operating multiple applications or APIs across varied environments.

Industries

E-commerce
Media & entertainment / streaming
Technology / SaaS
Online platforms / marketplaces

Roles / personas

Decision makers: CISO, VP Security/Engineering, Head of AppSec
Champions: AppSec engineers, platform/SRE leads, DevOps
Operators: SOC analysts for SIEM/SOAR integrations

Qualification criteria (good fit)

Requirement to secure multiple applications and APIs across hybrid environments
Desire for an API-driven WAAP that integrates with developer workflows and automation
Existing investment in Fastly edge services and a preference for tighter vendor integration

05The pitch

What the product does (core value proposition)

Fastly Next-Gen WAF is a web application firewall (WAF) and web application + API protection (WAAP) product that originated from Signal Sciences. It is designed to detect and mitigate application-layer (L7) attacks across web applications, APIs, and microservices. The product uses behavioral and anomaly detection techniques, supports centralized policy management, and offers multiple deployment models (edge, cloud-hosted, and on-premises/agent-based) rather than relying exclusively on static rule tuning typical of legacy WAFs. Fastly describes the product as providing protection across deployment locations from a single control plane and emphasizes reduced manual tuning in vendor materials; such claims should be validated during procurement and testing.

Target market and market positioning

- Primary buyers/users: security engineering/AppSec teams, platform engineering/SRE, and DevOps teams at mid-market to enterprise organizations. - Common environments: multi-cloud/hybrid architectures, containerized platforms, microservices/API-heavy environments, and organizations seeking a consistent WAF policy model across edge and origin locations. - Positioning theme: marketed as a WAAP solution with deployment flexibility (edge + core/on-prem + cloud) and an emphasis on operational approaches that aim to reduce tuning and false positives compared with some legacy WAF models.

Get a comprehensive analysis of Fastly Next-Gen WAF including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →