TL;DR: WAF protection is often inconsistent, with 52.3% of cloud-hosted assets and 66.4% of off-cloud assets uncovered, and even PII-collecting pages frequently left exposed, according to CYCOGNITO’s analysis of 500,000 internet-exposed assets. The operational issue is not the absence of WAFs but fragmented ownership, unknown assets, and inconsistent policy enforcement across teams.
At a glance
What this is: CYCOGNITO found that WAF coverage across internet-exposed enterprise assets is inconsistent, leaving a material share of cloud, off-cloud, and PII-collecting pages unprotected.
Why it matters: IAM and security teams should treat this as an inventory and governance problem as much as a perimeter control issue, because unknown assets and fragmented ownership create preventable exposure.
Context
Web application firewalls are meant to provide baseline protection for internet-facing applications, but that assumption only holds when coverage is complete, inventories are accurate, and policy ownership is clear. In practice, fragmented deployment across teams and vendors creates blind spots that leave exposed assets outside the control plane.
For identity and access teams, the intersection is indirect but real: login pages, registration flows, and other PII-handling surfaces are part of the external trust boundary, and inconsistent WAF coverage weakens the protective layer around human identity and credential workflows. The article’s findings are typical of large enterprises with distributed ownership and inconsistent visibility.
Key questions
Q: What breaks when internet-facing assets are left without WAF coverage?
A: When internet-facing assets are left without WAF coverage, attackers get a cleaner path to probe for credential stuffing, injection flaws, and unpatched vulnerabilities. The control failure is usually not isolated to one page. It reflects incomplete inventory, uneven ownership, and inconsistent enforcement across the external attack surface.
Q: Why does fragmented WAF ownership create more risk than a single team can see?
A: Fragmented ownership creates risk because each team may believe another team has covered the asset, while policies drift across vendors and regions. That breaks the assumption that protection is uniform. The practical result is blind spots around high-value applications that should have been inside the same security baseline.
Q: How should security teams verify that WAF coverage is actually complete?
A: Start with external discovery, not policy documents. Build a live inventory of internet-facing assets, map each one to an active WAF policy, and confirm a named owner for exceptions. Coverage is only real when the asset, the policy, and the operational responsibility all line up.
Q: What should teams do when login or checkout pages are uncovered?
A: They should treat uncovered login or checkout pages as priority exposure because those flows handle identity data and attract attacker reconnaissance. Confirm WAF placement, assign a named owner, and either protect the page or remove it from service if it has no current business purpose.
Technical breakdown
Why WAF coverage breaks down across distributed estates
A web application firewall only protects what it is actually in front of. In large estates, assets often sit behind multiple WAF products, managed by separate teams with different policy models, naming conventions, and rollout cadences. That fragmentation makes it difficult to prove whether every exposed application has equivalent protection. The control failure is not the absence of WAF technology but the absence of a single authoritative view of coverage and policy consistency. When inventory data is incomplete, security teams cannot distinguish a protected application from one that was simply assumed to be covered. Practical implication: reconcile external asset inventory against WAF enforcement points before assuming baseline application protection exists.
Practical implication: reconcile external asset inventory against WAF enforcement points before assuming baseline application protection exists.
How uncovered internet-facing assets create attack paths
Uncovered web applications become easier targets for credential stuffing, injection attacks, and exploitation of unpatched vulnerabilities. WAFs are often used as a compensating control while fixes are pending, so missing coverage expands the window in which an exposed service can be probed and abused. The risk is compounded when the application is high traffic or business critical, because the attacker does not need to find a deep foothold to create impact. One unprotected system can also provide a pivot into related services, data, or trust relationships. Practical implication: treat uncovered internet-facing assets as priority candidates for either protective placement or removal from service.
Practical implication: treat uncovered internet-facing assets as priority candidates for either protective placement or removal from service.
Why PII-collecting pages deserve stricter external protection
Pages that collect personally identifiable information, such as login forms, account creation screens, checkout pages, and password reset flows, sit at the edge where identity and application security meet. They are high-value reconnaissance targets because they concentrate authentication and data-entry activity. If these surfaces lack WAF coverage, attackers gain a cleaner path to abuse credential workflows, inject malicious input, or harvest data through predictable web interactions. The issue is less about a single control and more about governance of external trust boundaries: if the page handles identity data, it needs explicit ownership and protection. Practical implication: map all identity-adjacent web flows to confirmed WAF coverage and a named business owner.
Practical implication: map all identity-adjacent web flows to confirmed WAF coverage and a named business owner.
Threat narrative
Attacker objective: The attacker seeks direct access to exposed web applications in order to steal data, abuse authentication flows, or exploit application weaknesses without WAF interference.
- Entry occurs through internet-exposed web applications that are not protected by a WAF, allowing direct probing of the surface.
- Attackers then test the uncovered page for credential stuffing, injection flaws, or unpatched vulnerabilities because no filtering layer is enforcing baseline controls.
- Successful exploitation can lead to data access, service disruption, or lateral movement through a trusted application path.
- Impact includes exposure of data, compromise of services, and erosion of trust in the affected business-facing application.
Breaches seen in the wild
- Capital One breach 2019: A misconfigured firewall handed over its cloud role credentials, and an over-privileged role exposed data on 106 million people.
- ASP.NET machine key attacks 2025: Developers copied ASP.NET machine keys from public sources; attackers used one to run Godzilla via ViewState. Microsoft found 3,000+ such keys.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
WAF coverage gaps are fundamentally an asset-governance failure, not a tooling shortage. Enterprises often own enough WAF technology to feel protected while still leaving whole segments of the attack surface uncovered. That is a control-plane problem created by fragmented ownership, incomplete inventories, and inconsistent policy enforcement. Practitioners should stop measuring WAF maturity by product count and start measuring verified coverage across every internet-facing asset.
The named concept here is coverage assurance debt: the growing gap between assumed WAF protection and provable enforcement across the real estate. The debt accumulates when teams deploy WAFs by programme, region, or application rather than by a single external asset model. Over time, the organization ends up with a patchwork defence that looks comprehensive on paper but fails at the edge. Practitioners should treat assurance of coverage as a standing governance requirement.
PII-handling web flows deserve identity-aware protection, not just generic perimeter filtering. Login, registration, checkout, and password reset pages are the places where application security and identity risk intersect most sharply. When those surfaces are uncovered, the organization is effectively under-defending the pathways attackers use to target accounts and customer data. Practitioners should align WAF ownership with the systems that handle identity data and authentication flows.
Consolidation matters only if operational consistency follows. Operating a dozen WAF products can be defensible in a large enterprise, but only if policy standards, inventory reconciliation, and exception handling are centrally governed. Without that, multiple products become multiple blind spots. The practical conclusion is that standardisation and coverage verification matter more than the number of controls purchased.
External exposure management is now inseparable from application protection. If the security team cannot reliably enumerate what is internet-exposed, it cannot reliably assert that the perimeter is covered. This is where WAF governance, asset discovery, and business ownership converge. Practitioners should make external discovery a prerequisite for any meaningful WAF assurance programme.
What this signals
Coverage assurance debt: enterprises increasingly carry a hidden gap between the controls they believe are present and the controls that are actually enforced across the live attack surface. That gap grows when asset discovery, WAF ownership, and exception handling are managed separately, and practitioners should treat external exposure verification as a recurring governance task rather than a one-time control check.
The identity angle is important because web protection is strongest where authentication and personal-data flows are explicit, yet those are often the pages left to drift across teams. In practice, WAF governance should be tied to externally facing identity workflows, not just to application portfolios, because those workflows are the most likely to be probed first.
For practitioners
- Verify WAF coverage against the live external inventory Use black-box discovery to compare internet-facing assets with enforced WAF policy, then reconcile mismatches by business owner and application tier.
- Prioritise PII-collecting pages for explicit protection Require confirmed WAF placement for login, registration, checkout, password reset, and other identity-adjacent flows that handle personal data.
- Consolidate policy ownership across teams Assign a single operational standard for WAF configuration, exception handling, and drift review so separate teams do not create inconsistent coverage.
- Triage uncovered assets for protection or retirement Bring exposed systems under protection quickly or remove them if they no longer have a business purpose, especially when they are high traffic or customer facing.
- Review uncovered assets for compensating control gaps Check whether WAF was being relied on as the temporary control while fixes were pending, and escalate any assets that were left without an alternative safeguard.
Key takeaways
- WAF gaps persist because enterprises often manage protection as a collection of tools and teams rather than as a single external-coverage problem.
- The most exposed pages are often the ones that matter most, including login, registration, checkout, and password reset flows.
- The fastest way to reduce risk is to verify live coverage against the real internet-facing estate and either protect or retire uncovered assets.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | WAF gaps expose externally reachable applications whose access boundaries are not consistently enforced. |
| ID.AM-01 — Physical devices and systems within the organisation are inventoried | The article’s core failure is incomplete visibility into internet-exposed assets and their protection state. | |
| Recommendation — Map exposed applications to PR.AA-05 and verify that external access boundaries are consistently enforced. Inventory every internet-facing asset and reconcile it against active WAF enforcement points. | ||
| CIS Controls v8 | CIS-1 — Inventory and Control of Enterprise Assets | Uncovered assets persist when enterprise asset inventory does not match the live attack surface. |
| Recommendation — Use enterprise asset inventory to identify exposed systems that lack WAF coverage. | ||
| MITRE ATT&CK | TA0001;TA0006;TA0009 — Initial Access; Credential Access; Collection | The article highlights attack paths involving probing, credential abuse, and data collection on exposed web assets. |
| Recommendation — Map uncovered web applications to initial access, credential abuse, and collection techniques in your detection and triage workflow. | ||
| OWASP ASVS | V8 — Authorization | Unprotected login and checkout flows weaken authorization boundaries on internet-facing applications. |
| Recommendation — Apply authorization verification to internet-facing flows that handle identity and personal data. | ||
Key terms
- WAF Coverage Assurance: The practice of verifying that every internet-facing application is actually protected by a web application firewall, not just assumed to be covered. It depends on live asset discovery, policy reconciliation, and clear ownership so protection can be proven across the full external attack surface.
- Coverage Assurance Debt: The accumulated gap between the protection an organisation believes it has and the protection that is actually enforced on exposed assets. It grows when inventory, ownership, and policy management are fragmented, creating blind spots that are easy to miss until an attacker finds them.
- Digital Attack Surface: The digital attack surface is the set of internet-facing systems, applications, endpoints, cloud services, and APIs that can be reached or abused by an external actor. It changes constantly as environments expand, so teams need ongoing discovery and monitoring rather than one-time inventories or periodic scans.
- Identity-Adjacent Web Flow: A web journey that directly supports account creation, authentication, recovery, or transaction trust, such as login, sign-up, checkout, or password reset. These flows deserve priority because attacks against them can lead to credential abuse, account takeover, or fraud even when core IAM controls are intact.
Deepen your knowledge
NHI Foundation Level course covers NHI governance, machine identity security, IAM, and secrets management through the industry's only accredited NHI security programme. It helps practitioners connect identity governance to the broader security controls that make external exposure safer to manage.
Published by the NHIMG editorial team on August 20, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org