Topic starter
06/09/2026 3:45 pm
TL;DR: WAFs and WAAP platforms reduce perimeter risk in modern application environments, but LEVO argues they still stop at request inspection and cannot validate authorization correctness, data exposure, or internal API behaviour after traffic is accepted. Runtime API security becomes the missing layer for proving that APIs behave safely in production, not just that they filter attacks at the edge.
Editorial analysis by NHI Mgmt Group, based on content published by LEVO: “From WAF to WAAP to Runtime API Security: What Enterprises Actually Need”.
Key questions
Q: What breaks when edge controls are used as proof of API security?
A: Edge controls can show that a request was filtered or shaped correctly, but they do not prove that the service enforced the right authorization decision after acceptance.
Q: Why do authenticated API users still create security risk?
A: Because valid credentials can still be abused.
Q: What are the signs that a WAAP-only approach is failing to protect APIs?
A: The main warning signs are missed low and slow reconnaissance, weak detection of behavioral anomalies, and poor visibility into whether requests match expected user intent.
Practitioner guidance
- Map API trust boundaries to execution points Document where authentication ends and authorization, object selection, and response construction begin so you know which decisions edge controls cannot validate.
- Validate runtime behaviour for sensitive APIs Prioritise production observation for APIs that handle regulated data, internal service calls, partner callbacks, or delegated machine access.
- Inventory shadow and undocumented endpoints Find internal routes, callbacks, and service-to-service interfaces that never pass through WAF or WAAP enforcement and bring them into governance.
Bottom line: WAFs and WAAP platforms still do useful work at the edge, but they do not prove that APIs enforce the right access decision after acceptance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 3:45 pm
Edge security is necessary but no longer sufficient for modern API governance. WAFs and WAAP platforms still matter because they reduce classic abuse and enforce structure at the boundary. But the core governance problem has moved inward: modern application risk now depends on whether services make the right decision after authentication. Practitioners should treat edge controls as a first line, not the evidence that an API is behaving safely.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should organisations rely on WAF, WAAP, and runtime API security together?
A: Use all three when applications are API-heavy, distributed, or identity-driven. WAF filters classic web attacks, WAAP adds API-aware edge inspection, and runtime API security validates what happens after acceptance. If you only have perimeter controls, you can reduce noise without proving that access, data return, and internal workflows are safe.
👉 Read our full editorial: WAF, WAAP and runtime API security: why edge controls fall short