AI
Static Rule Sets and Missing Business Context
Nobody likes WAF. Static rule sets block live traffic without business context. A production log shows a random POST request to a checkout API returning 403 with no explanation. Engineers cannot map rules to infrastructure or revenue flows. Visibility gaps make it impossible to prioritize attacks. Executives see revenue loss from false positives and demand WAF be shut down. The result: finger-pointing, wrong people paged, and no financial risk quantification.
From WAF to Edge Security Layer
Today’s architecture has four separate layers: CDN, WAF, load balancer, and compute. Each has its own dashboard and configuration. Traffic from customers, automation, and AI agents gets lost in the noise. The proposed solution treats these as one edge security layer. A unified view maps DNS, CDN, WAF rules, load balancer, and compute together. It surfaces drifts like a load balancer directly accessible from the internet, bypassing all WAF protection.
AI-Driven Remediation with Agentic Loops
When 3,000 requests are blocked on a booking endpoint, AI enriches the logs with business context. It identifies the payload contains two hyphens from a Meta Pixel ad campaign cookie. An agentic flow generates a remediation rule, backtests it against past traffic, and iterates until confidence is high. The agent then deploys the rule across all CDN zones, logs the decision, and notifies the app owner. This automation is necessary at scale — some companies manage 10,000 rules.
TikTok’s Multi-CDN WAF Automation
TikTok protects 1 billion monthly active users across thousands of domains and four CDNs. Previously, blocking an attack required opening four consoles, sharing telemetry, and took over 30 minutes. With the unified framework, one AI-learned policy deploys to all CDNs in under 3 minutes. The AI first runs the policy in log-only mode, analyzes traffic for false positives, and only then enforces it. Bot detection improved by learning new scraping techniques and identifying detection drift from live traffic.
Real-World Detection: Booking Endpoint and Bypass Paths
A company saw a spike in 4xx responses on a booking endpoint. The AI engine isolated the pattern: requests blocked on the bookings/tickets API with cookies containing two hyphens. Enrichment revealed the hyphens came from a Meta Pixel ad campaign ID. The remediation excluded two hyphens in cookies only for that endpoint. In another case, the engine mapped Cloudflare to AWS and found the load balancer was directly accessible from the internet, bypassing all WAF rules. The fix: reconfigure the routing path.
Vendor Lock-In and Practical Steps
Migrating between CDNs means rewriting rules. An AWS WAF rule blocking an admin route is eight lines; the same rule on Cloudflare is two lines. With 500 rules, manual translation takes years. The unified framework extracts configurations, translates them to a neutral format, and deploys to any provider. Engineers should audit every rule on skip or bypass, examine the top 10 blocked routes, and test traffic in log mode before blocking. CISOs must ask how edge security effectiveness is measured, how traffic patterns reveal business loss, and how AI improves team efficiency without adding headcount.
Q&A
How is the confidence score calculated in the verdict engine? The score considers traffic volume, rule type (managed vs. custom), endpoint specificity, rule freshness, and configuration change history. ▶ 39:40
How many engineers are required to make the AI-assisted WAF functional? It depends on scale and complexity. One engineer who understands WAF and business context can start by building CLI tools and gaining visibility. ▶ 40:54
Notable Quotes
nobody likes W. It’s the problem which is uh also the title of this section but also the actual uh reality of it. Roy Weisfeld · ▶ 3:13
it’s really impossible for us to understand you know what what the intent of this log is and there’s no business context Surya Pentakota · ▶ 4:10
we’re not replacing VA wafs we are not replacing CDNs and VAF and CDN have been there for more than 30 years and they’re here to stay Surya Pentakota · ▶ 22:57
attackers are not going to wait for that even if it’s two days of log mode. Attackers are going to attack you in minutes so you should make changes happen faster. Roy Weisfeld · ▶ 36:59
Key Takeaways
- Audit every WAF rule on skip or bypass; remove what you cannot explain.
- Test rules in log-only mode against past traffic before blocking.
- Use AI to automate policy deployment and backtesting across multi-CDN environments.