WAF coverage gaps leave internet-exposed assets inconsistently protected

At a glance

What this is: This is an analysis of large-scale WAF coverage across enterprise internet-facing assets, finding that protection is frequently uneven and that many exposed systems remain outside baseline web defence.

Why it matters: For IAM, NHI, and broader security teams, uneven perimeter protection matters because exposed web assets often sit in front of authentication, account recovery, and application access flows that credential-driven attacks target first.

By the numbers:

• 52.3 percent
• 66.4 percent
• On average, enterprises in the dataset operated 12 different WAF products, with a median of 11.
• 39.3 percent of PII-collecting assets lacked WAF protection., lacked WAF protection.

👉 Read CYCOGNITO's analysis of WAF coverage gaps across enterprise internet-facing assets

Context

Web application firewall coverage is only useful when it is complete, consistent, and aligned to the assets that actually matter. In practice, many enterprises accumulate multiple WAF products, different policy models, and separate ownership lines, which creates gaps that are easy to miss until an exposed application is probed or abused.

That matters for identity security because login portals, registration flows, password reset pages, and checkout paths are often the first place attackers test credential stuffing and injection techniques. When those surfaces are inconsistently protected, the weak point is not just application security posture, but the trust boundary around identity-bearing workflows.

For security and identity teams, this is a governance problem as much as a tooling problem. The starting position described in the article is not unusual for large enterprises, which means the main challenge is getting from assumed coverage to verified coverage across the external attack surface.

Key questions

Q: How should security teams verify that WAF coverage is actually complete?

A: Start with external discovery, not policy documents. Build a live inventory of internet-facing assets, map each one to an active WAF policy, and confirm a named owner for exceptions. Coverage is only real when the asset, the policy, and the operational responsibility all line up.

Q: Why do uncovered login and PII pages create outsized risk?

A: Because they sit directly in front of identity and transaction flows. If those pages are exposed without a WAF, attackers get a cleaner path to credential stuffing, injection attempts, and account abuse. The business impact can extend from fraud to data loss and downstream trust erosion.

Q: What do security teams get wrong about owning multiple WAF products?

A: They often assume more products equal more protection. In reality, multiple WAFs with different policy models and owners can create inconsistency, tuning drift, and blind spots. The core question is not how many tools exist, but whether every exposed asset is covered and governed the same way.

Q: Who is accountable when exposed assets are left without WAF protection?

A: Accountability should sit with the team that owns the asset and the security function that governs external exposure standards. If the asset is absent from inventory, accountability has already failed at the governance layer. The fix is ownership assignment, exception tracking, and regular exposure reconciliation.

Technical breakdown

Why WAF coverage fragments across large enterprises

WAF fragmentation usually comes from years of separate procurement, regional deployment, and team-specific operating models. Each product has its own policy language, tuning approach, logging behaviour, and exception handling, so coverage can look strong at the control level while still leaving individual assets outside protection. The operational risk is not just missed detection. It is drift between what security believes is covered and what is actually enforced across the live attack surface.

Practical implication: build a single inventory of externally exposed assets and reconcile it to WAF enforcement before assuming perimeter coverage exists.

Why uncovered login and PII pages matter

Pages that collect PII, handle sign-up, or support password recovery are privileged application surfaces because they sit close to account creation and authentication. If those pages are exposed without a WAF, attackers get a cleaner path to credential stuffing, injection attempts, and exploit chaining, with fewer rate limits or request inspection controls in the way. In identity terms, the weak point is often not the directory or IAM platform itself, but the edge workflow that feeds it.

Practical implication: prioritise WAF verification on identity-adjacent web flows, not just on the most visible customer-facing applications.

What unknown assets mean for control assurance

Unknown assets are a governance failure because a control can only protect what has been discovered, classified, and assigned to an owner. Black-box discovery matters here because formal inventories often lag behind reality, especially in large estates with shadow IT, acquired applications, or forgotten regional services. Once an asset is absent from the inventory, it is also absent from policy review, exception management, and coverage reporting, which turns a technical gap into an assurance gap.

Practical implication: combine external discovery with ownership assignment so every exposed asset can be triaged into protect, remediate, or retire.

Threat narrative

Attacker objective: The objective is to use an uncovered web application as a low-friction route into accounts, sensitive data, or deeper enterprise systems.

1. Entry begins with attackers finding an internet-exposed application that has no WAF in front of it, often through broad reconnaissance of login or PII-handling pages.
2. Escalation follows when the unprotected surface allows credential stuffing, injection attempts, or exploitation of an unpatched flaw without request filtering or anomaly controls.
3. Impact occurs when the exposed system becomes an entry path to data theft, account takeover, or further movement into the network and connected services.

NHI Mgmt Group analysis

Coverage drift is the real control failure here. The problem is not whether an organisation owns a WAF product, but whether every exposed asset is actually covered by a policy that matches its risk. Fragmented deployment across teams and regions creates a false sense of perimeter control. In a modern external attack surface, coverage assurance is the control, not the product count.

Identity-bearing web flows deserve perimeter priority. Login, registration, password reset, and checkout pages are not generic web pages. They are trust-entry points that feed account creation and authentication workflows, so exposure there has direct implications for IAM, fraud, and credential abuse. For identity teams, this is where application security and identity governance meet.

Unknown internet-facing assets are governance debt. If a system is not in the external inventory, it cannot be consistently protected, reviewed, or retired. That makes black-box discovery and ownership assignment foundational controls, not optional hygiene. Enterprises that cannot reconcile exposed assets to owners will continue to operate with blind spots.

Consolidation without standardisation does not fix coverage gaps. Multiple WAF products can coexist for years, but the operational burden rises faster than the security value if policy models, exception handling, and monitoring remain inconsistent. The category lesson is that control uniformity matters more than control variety. Practitioners should treat standardisation as a risk-reduction objective.

WAFs are a compensating control, not a substitute for application governance. The article shows how often organisations rely on WAF coverage as a seat belt while leaving some vehicles unbuckled. That means asset lifecycle governance, discovery, and ownership are inseparable from effective web protection. Security leaders should use WAF findings as a signal of wider governance maturity.

What this signals

Coverage assurance is becoming a governance discipline, not a tooling metric. The lesson from this analysis is that teams need continuous reconciliation between exposed assets, control enforcement, and ownership. For identity-heavy applications, that means treating external discovery and access-path review as part of the same assurance cycle. The practical next step is to align exposure management with the NIST Cybersecurity Framework 2.0 and the NHI Lifecycle Management Guide, where identity-adjacent workflows are involved.

Identity workflows expand the blast radius of weak perimeter coverage. A missed WAF on a password reset or account creation flow is not just an application bug, because it changes the trust conditions around identity onboarding and recovery. That makes this a useful reminder for IAM and fraud teams to include application-edge controls in their governance model, not just directory controls.

External discovery should feed exception closure, not just reporting. If uncovered assets are identified but not triaged into protect, remediated, or retired, the organisation has only documented risk, not reduced it. Teams should measure how many exposed assets remain unresolved after discovery and use that metric as a signal of operational maturity.

For practitioners

• Verify external asset coverage against WAF enforcement Run black-box discovery across all internet-facing properties, then reconcile each asset to an active WAF policy and named owner. Close gaps before assuming the perimeter is covered, especially where applications are business-critical or frequently changed.
• Prioritise identity-adjacent web flows Place login, registration, password reset, and account recovery pages at the top of the remediation queue because they are the most likely entry points for credential stuffing and related abuse. Confirm inspection, rate limiting, and exception handling on these paths.

Key takeaways

• WAF gaps are common even in large enterprises, which means assumed perimeter protection is not a reliable control posture.
• The most consequential exposures are often identity-adjacent pages, where credential attacks and account abuse can begin.
• Discovery, ownership, and policy consistency are the controls that close the gap, not simply adding more WAF products.

Key terms

• WAF Coverage Drift: The gap that appears when a security control exists in policy or procurement terms but not across every live asset that should be protected. In practice, it is created by fragmented ownership, inconsistent policy models, and assets that were never reconciled back into coverage reporting.
• Asset Inventory: An asset inventory is a managed record of the systems, identities, and resources an organisation needs to govern. For NHI security, it becomes the starting point for ownership, exposure analysis, and lifecycle action because you cannot rotate or offboard what you cannot reliably see.
• Identity-Adjacent Web Flow: A web journey that directly supports account creation, authentication, recovery, or transaction trust, such as login, sign-up, checkout, or password reset. These flows deserve priority because attacks against them can lead to credential abuse, account takeover, or fraud even when core IAM controls are intact.

What's in the full report

CYCOGNITO's full analysis covers the operational detail this post intentionally leaves for the source:

• Asset-level coverage methodology for identifying internet-exposed systems across large enterprise estates
• The manual validation approach used to separate business-critical assets from noise and parked domains
• The full vendor breakdown of WAF technology diversity and deployment fragmentation across teams
• The asset triage approach for deciding whether uncovered systems should be protected or retired

👉 CYCOGNITO's full post includes the coverage methodology, uncovered asset examples, and remediation guidance.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, workload identity, and identity lifecycle control. It is designed for practitioners who need to connect identity assurance to broader security operations and governance.