Global Tool Radar

Security & Privacy / Web Application Firewall (WAF) Software

Fastly Next-Gen WAF Review, Pricing, Pros & Cons

Fastly Next-Gen WAF is a hybrid web application and API firewall that uses contextual request detection, shared threat intelligence, signals, rules, thresholds, and centralized visibility across edge, Fastly-hosted cloud, and customer-managed deployments.

Research by Global Tool Radar Research SystemEvidence checked: Aug 12, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Visit product websiteChoose similar tools to compare

Buying snapshot

Quick buying snapshot

A compact view of who this tool fits, what it costs, and what to confirm before choosing it.

Best for
  • You need one WAF control plane across edge, cloud, Kubernetes, PaaS, and on-premises applications: Fastly supports Edge WAF, Fastly-hosted Cloud WAF for qualifying purchase routes, customer-managed On-Prem WAF, PaaS embeddings, reverse proxy, module-agent, and Kubernetes patterns, including mixed deployments.
  • Your priority is contextual detection with low false-positive tuning overhead: SmartParse evaluates request context and execution behavior, while signals and thresholds support progressive monitoring and blocking rather than relying only on regex signatures.
More buying conditions
  • Security and platform teams need programmable rules, validation, alerts, and shared evidence: The product provides APIs, Terraform support, account and workspace rules, a request simulator, dashboards, reports, audit logs, and alert integrations with common operations tools.
Not for
  • You need a public self-service price and fixed contract assumptions: Fastly publishes contact-sales pricing only; numeric amount, currency, billing cadence, minimums, commitment, renewal, implementation, and overage terms require a quote.
  • You expect complete DDoS, bot management, API discovery, and managed response in the base WAF price: Fastly publishes those as separate products or services and bundles selected entitlements only in broader Security packages.
More buying conditions
  • You cannot operate customer-managed software but also cannot route traffic through an eligible Fastly-managed deployment: On-Prem WAF and PaaS methods require customer-managed integration and egress, while Edge WAF requires a Fastly delivery account and Cloud WAF availability depends on the purchase and control-panel route.
Pricing
  • Fastly sells the Essential, Professional, and Premier Next-Gen WAF platforms through sales-assisted quotes. Public sources establish tier and feature boundaries but do not publish a tier-specific amount, currency, priced unit, invoice cadence, minimum purchase, contract duration, renewal term, implementation fee, or usage overage.
  • Essential · Requires quote · custom quote
Free or trial access
  • No permanent free Fastly Next-Gen WAF plan or time-limited Fastly Next-Gen WAF trial is publicly stated. The product page offers a demo, which is not a plan or trial.

Product scope

Product functionality and purchase scope

The evaluated product is the current Fastly Next-Gen WAF across its Essential, Professional, and Premier platforms: SmartParse and system-signal detection, Network Learning Exchange intelligence, rules and thresholds, web and multi-protocol API inspection, dashboards, alerts, APIs, and supported edge, Fastly-hosted, and customer-managed deployment methods.

Product checked: Aug 12, 2026

Functionality reviewed
  • Essential, Professional, and Premier Next-Gen WAF platforms
  • SmartParse contextual detection, system signals, Network Learning Exchange intelligence, thresholds, and enforcement modes
  • Professional and Premier custom signals and templated API, account-takeover, and virtual-patch rules
  • Premier advanced rate limiting subject to documented limits
  • Web application, REST, SOAP, GraphQL, gRPC, WebSocket, and microservice traffic inspection
  • Edge WAF, Cloud WAF where the purchase route permits it, On-Prem WAF, supported PaaS, reverse-proxy, module-agent, and Kubernetes patterns
  • Next-Gen WAF dashboards, reports, alerts, API access, Terraform support, redaction, and IP-anonymization controls
Non-target functionality excluded from scoring
  • Fastly Security Core, Security Core Plus, Security Total, Security Starter, Security Advantage, and Security Ultimate package bundles
  • Fastly DDoS Protection beyond the WAF's own threshold-based application-layer controls
  • Fastly Bot Management and Fastly AI Bot Management
  • Fastly API Security and API Discovery beyond WAF request inspection and targeted rules
  • Fastly Client-Side Protection and separately entitled Edge Rate Limiting
  • Response Security, Managed Security Professional, Managed Security Enterprise, professional services, and separate support plans
  • Fastly Full Site Delivery, CDN, Compute, TLS, and observability products
  • A10 Thunder or vThunder feature licenses and A10-provided support
  • Fastly Legacy WAF as a separate legacy product
  • Signal Sciences branding, legacy control-panel terminology, and legacy download domains as separate current products or plans
Purchase paths

Pricing checked: Aug 12, 2026

  • Fastly Security Core, Core Plus, and Total packages: Broader current Security packages include Next-Gen WAF with package-specific workspaces and custom rules. Core Plus and Total also bundle selected DDoS Protection, Client-Side Protection, Bot Management, API Discovery, or Edge Rate Limiting entitlements; these package names are not WAF plans.
  • Fastly Security Starter, Advantage, and Ultimate packages: A second current packaged-offering family maps Essential, Professional, and Premier base platforms to package-specific RPS, workspace, edge-rate-limit, support, and service entitlements. Its package limits are not generalized as standalone WAF tier limits.

Pricing plans

Fastly Next-Gen WAF pricing table

Pricing checked: Aug 12, 2026

Official factConfidence 98%2 linked sources

All three exact-product platforms require a quote. Essential is the baseline platform, Professional adds custom signals and templated rules, and Premier adds advanced rate limiting. Fastly also publishes two broader Security package families that include Next-Gen WAF alongside package-specific capacity, support, services, or adjacent products; those bundles are purchase paths rather than WAF plans.

Official pricing page
PlanPriceKey differencesBest for
EssentialFastly Next-Gen WAF Essential platformSupporting pricing evidence
  • Requires quote · custom quote
  • Custom signals: Not available; System signals remain available.
  • Templated API, account-takeover, and virtual-patch rules: Not included; Professional or Premier required.
  • Advanced rate limiting: Not included; Premier or a qualifying packaged offering required.
Teams needing baseline contextual WAF detection, system signals, monitoring, and blocking without custom signals, templated rules, or advanced rate limiting.
ProfessionalFastly Next-Gen WAF Professional platformSupporting pricing evidence
  • Requires quote · custom quote
  • Custom signals: Account-level and workspace-level custom detection signals; Configured through supported control panel or API.
  • Templated API, account-takeover, and virtual-patch rules: Partially pre-constructed API, ATO, and CVE rules; Rule selection and configuration required.
  • Advanced rate limiting: Not included; Premier or a qualifying packaged offering required.
Application-security teams that need custom signals, reusable templated API and account-takeover rules, virtual patches, dashboards, alert integrations, and broader policy control without Premier advanced rate limiting.
PremierFastly Next-Gen WAF Premier platformSupporting pricing evidence
  • Requires quote · custom quote
  • Custom signals: Account-level and workspace-level custom detection signals; Configured through supported control panel or API.
  • Templated API, account-takeover, and virtual-patch rules: Partially pre-constructed API, ATO, and CVE rules; Rule selection and configuration required.
  • Advanced rate limiting: Per-client threshold rules with block or log actions; Documented rule and client-identifier limits apply.
  • Advanced rate-limiting-rule limit: 15 advanced rate limiting rules; Per site or workspace.
Large application estates that need the complete Next-Gen WAF platform, including custom signals, templated protections, and per-client advanced rate limiting.

Plan upgrade triggers

Verified plan boundaries that can change the required edition.

Essential Professional

The team needs custom signals or templated API, account-takeover, and CVE virtual-patch rules that Essential does not include.

Supporting pricing evidence
Professional Premier

The application needs Next-Gen WAF advanced rate limiting, which is included only with Premier or certain broader package offerings.

Supporting pricing evidence
What is included, connected, or sold separately

Product scope

What is included, connected, or sold separately

Material capabilities are separated by their verified relationship to the target product.

CSOC monitoring, incident response, and security guidanceAdd-on

Response Security, Managed Security Professional, and Managed Security Enterprise are services, not inherent WAF software capabilities.

Fastly Managed Security services
Official source
Contextual request detection with shared threat intelligenceIncluded capability

SmartParse and Network Learning Exchange are core Next-Gen WAF technologies; this does not imply the separately sold Bot Management or DDoS Protection engines.

Official source
Targeted protection for REST, SOAP, GraphQL, gRPC, and WebSocket APIsIncluded capability

Core WAF inspection and rules do not establish automatic API inventory, posture, or a full API security lifecycle.

Official source
Templated API, account-takeover, and CVE virtual-patch rulesIncluded capability

This relation covers the WAF's templated rules, not API Discovery or a managed patching service.

Plan: Essential: Included · Professional: Included · Premier: Included
Official source
Advanced per-client rate limiting on PremierPlan-dependent capability

Certain broader packages may carry separate edge-rate-limit entitlements; those package counters and penalty boxes are not Premier plan facts.

Plan: Essential: Unavailable · Professional: Unavailable · Premier: Included
Official source
Custom account and workspace detection signalsPlan-dependent capability

Essential retains system signals but cannot create custom signals.

Plan: Essential: Unavailable · Professional: Included · Premier: Included
Official source
Adaptive Fastly DDoS mitigation and legitimate-traffic billingSeparate product

The WAF has threshold and abuse controls, but Fastly's adaptive DDoS product is a separate entitlement that selected Security packages bundle.

Fastly DDoS Protection
Official source
Automatic API discovery and inventorySeparate product

Next-Gen WAF supplies targeted API traffic rules; discovery and inventory are separately packaged.

Fastly API Security and API Discovery
Official source
Dedicated bot classification, client detection, and challengesSeparate product

Post-cache Bot Management requires its own purchase and Edge WAF; Essential explicitly does not support Bot Management.

Fastly Bot Management
Official source
Embedded Next-Gen WAF on A10 Thunder and vThunderThird-party integration

This deployment requires an A10 feature license, and A10 provides support for the A10 deployment.

A10 Networks Thunder ADC
Official source
How the score is calculated

Scoring method

How the score is calculated

The score uses the category-specific buying dimensions below and their displayed weights.

This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.

Evidence confidence
85%
AI claim confidence
99%
Required-field evidence status
100%
Evidence freshness
54%
Field traceability
100%
Model agreement
91%
Why this confidence level
  • Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
  • Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
  • 8 of 8 weighted claims have evidence links.
  • 11 A1 documentary official sources and 4 A2 official product sources are linked.
  • 2 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
  • 4 weighted claims are past the review window.
  • No blocking evidence conflict was identified.
Protection efficacy20%
84

Employs smart parsing and reputation-based intelligence to mitigate web threats, but overall effectiveness in lower plans is limited by the lack of custom signatures or virtual-patch rules.

Policy accuracy and tuning17%
81

Lowers false-positive overhead through contextual analysis, but the policy simulator fails to test advanced rate limiting, deception, or geolocation rules.

Application and API coverage15%
87

Protection is explicitly supported for web applications, REST, SOAP, GraphQL, gRPC, WebSocket, and microservice traffic, which gives the product broad application and API scope for modern estates.

Security operations14%
75

Integrates with DevSecOps tools like Terraform and provides API-driven visibility, but active managed incident response requires a separate professional service engagement.

Performance and reliability13%
75

The platform supports several deployment patterns, including edge and customer-managed options, but customer-run environments require compatibility checks, updates, capacity, and network egress, which places reliability responsibility partly on the buyer.

Deployment and integrations11%
87

Offers wide deployment flexibility across edge, cloud, reverse-proxy, and agent architectures, alongside integrations with standard notification and alert platforms.

Support and total cost10%
53

All platforms require custom quotes with no public amount, currency, cadence, commitment, or overage detail, and package-specific support, RPS, workspace, or managed-service entitlements plus optional bot, DDoS, and response products can change total cost outside the base WAF tier.

Public review signals

Review aggregates favor effective protection and support, with configuration and pricing cautions

Current exact-product Gartner Peer Insights and G2 aggregates are positive. Visible review material commonly values deployment flexibility, low false-positive operation, visibility, integrations, and responsive support, while some reviewers cite advanced-rule complexity, interface limitations, and sales-led pricing as concerns.

Public review signals updated: Aug 12, 2026

Commonly reported strengths

  • Effective web and API attack detection with low day-to-day tuning
  • Flexible deployment and developer-oriented integrations
  • Responsive Fastly security and support teams

Commonly reported concerns

  • Advanced rule configuration can require specialist knowledge
  • Some interface and rule-detail workflows are less transparent than reviewers want
  • Pricing is sales-assisted and can become a concern as protected scope grows
G24.2/5
Review count
30 reviews
Source context
Fastly Next-Gen WAF on G2Exact product
View sourceHistory baseline established: Aug 12, 2026
Gartner Peer Insights4.8/5
Rating count
542 ratings
Source context
Fastly Next-Gen WAF on Gartner Peer InsightsExact product
View sourceHistory baseline established: Aug 12, 2026
Score79
Pricing modelFastly sells the Essential, Professional, and Premier Next-Gen WAF platforms through sales-assisted quotes. Public sources establish tier and feature boundaries but do not publish a tier-specific amount, currency, priced unit, invoice cadence, minimum purchase, contract duration, renewal term, implementation fee, or usage overage.
Use caseprotect web applications, APIs, and microservices across edge, cloud, Kubernetes, PaaS, and on-premises environments with contextual detection and low-tuning enforcement
Company sizeEnterprise, Mid-market
Structured tags

Fastly Next-Gen WAF tag profile

Company size
  • Enterprise
  • Mid-market
Key features

Fastly Next-Gen WAF core capabilities

  • SmartParse contextual detection for malicious and anomalous request payloads
  • Network Learning Exchange shared reputation and attack intelligence
  • System and custom signals, thresholds, request rules, exclusions, deception, and staged blocking
  • Templated API, account-takeover, and CVE virtual-patch rules on Professional and Premier
  • Premier advanced rate limiting with per-client identification and threshold actions
  • Protection for web applications, REST, SOAP, GraphQL, gRPC, WebSocket, and microservice traffic
Detailed strengths and purchase cautions
Pros

Why it is worth considering

  • SmartParse contextual detection plus Network Learning Exchange reputation intelligence can support blocking of malicious and anomalous payloads with system signals and staged controls.
  • The product covers web applications along with REST, SOAP, GraphQL, gRPC, WebSocket, and microservice traffic under one WAF policy model.
  • Deployment options include Fastly edge, Fastly-hosted cloud on eligible routes, on-premises, PaaS, reverse-proxy, module-agent, and Kubernetes patterns for mixed estates.
  • Professional and Premier add account- and workspace-level custom signals plus templated API, account-takeover, and CVE virtual-patch rules that buyers can select and configure.
Cons

What to confirm before buying

  • Every Essential, Professional, and Premier platform is sold only through custom quote, so buyers cannot validate numeric price, invoice cadence, commitment term, or overage before sales engagement.
  • Essential omits custom signals, templated API/ATO/CVE rules, and advanced rate limiting, so baseline buyers must plan for Professional or Premier when those controls are required.
  • Advanced rate limiting is Premier-only, limited to 15 rules per site or workspace, and uses documented client-identifier constraints that can bound high-volume abuse controls.
  • Fastly Bot Management, adaptive DDoS Protection, automatic API discovery, client-side protection, and 24-hour managed response are separate products or services and are not inherent entitlements of every WAF tier.
Cross-model buying perspectives

Multi-AI review

Cross-model buying perspectives

Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.

AI assessment updated: Sep 22, 2026

Score comparisonGeminiGPTxAIRange
Protection efficacy8485841
Policy accuracy and tuning8083803
Application and API coverage8290908
Security operations75807010
Performance and reliability85726817
Deployment and integrations8888844
Support and total cost65425223
waf attack detection blocking8588863
waf policy tuning control8084786
waf api bot protection fit7074724
waf performance availability85706817
waf event visibility response7882766
Where models differ
  • Support and total cost: 42–65 (23-point range)
  • Performance and reliability: 68–85 (17-point range)
  • waf performance availability: 68–85 (17-point range)
GeminiAI-assisted buyer perspective80

A flexible, hybrid WAF that uses contextual detection instead of rigid signatures, making it well-suited for multi-cloud and hybrid estates, provided buyers are willing to navigate quote-based pricing and purchase separate add-ons for dedicated DDoS and bot management.

Review confidence
80/100
Model details
Strengths
  • Flexible deployment architectures allow routing traffic through Fastly's edge, hosted cloud, or customer-managed environments like Kubernetes, PaaS, and on-premises networks.
  • SmartParse contextual analysis and Network Learning Exchange reputation intelligence help identify malicious request payloads without the operational overhead of heavy signature tuning.
  • Broad protocol coverage protects traditional web applications alongside REST, SOAP, GraphQL, gRPC, and WebSocket APIs.
Cautions
  • Core policy customization tools like custom signals and pre-constructed rules are excluded from the Essential tier, forcing an upgrade to Professional or Premier.
  • Advanced bot management, adaptive DDoS protection, and automated API discovery are separate products that can increase overall security costs.
  • On-premises, PaaS, and Kubernetes deployments require customer-managed components, software updates, local capacity planning, and network egress management.
GPTAI-assisted buyer perspective78

Fastly Next-Gen WAF fits application-security teams that need contextual web and API attack detection with deployment options across edge, Fastly-hosted cloud, and customer-managed environments, but the right plan depends on whether custom signals, templated rules, or Premier advanced rate limiting are required and on whether the buyer is comfortable with quote-based procurement.

Review confidence
78/100
Model details
Strengths
  • The product supports mixed web, REST, SOAP, GraphQL, gRPC, WebSocket, and microservice traffic, so teams protecting diverse application paths can use one WAF platform across several request types.
  • Professional and Premier add custom signals, and Professional and Premier also include templated API, account-takeover, and virtual-patch rules, which gives security teams more policy-control options than the Essential platform.
  • Premier adds advanced rate limiting with per-client threshold actions, which can help teams that need finer control over abusive request patterns at the application layer.
  • The platform supports edge, Fastly-hosted cloud, on-premises, PaaS, reverse-proxy, module-agent, and Kubernetes deployment patterns, which can fit organizations with mixed infrastructure boundaries.
Cautions
  • All three WAF platforms are quote-based, and the supplied facts do not publish a numeric subscription amount, commitment term, or self-service checkout path.
  • Essential does not include templated API, account-takeover, and virtual-patch rules, so buyers that need those named controls must move to Professional or Premier.
  • Advanced rate limiting is only available on Premier at the platform level, and the documented per-site and client-identifier constraints matter for buyers sizing that capability.
  • On-premises, PaaS, and Kubernetes deployments require customer-managed components, compatibility checks, updates, capacity, and network egress, which puts more operational responsibility on the buyer.
xAIAI-assisted buyer perspective76

Fastly Next-Gen WAF fits mid-market and enterprise teams that need contextual detection across web, API, and microservice traffic with flexible edge, cloud, or customer-managed deployment, provided the buyer accepts sales-quoted packaging and confirms whether Professional or Premier features and any separate bot, DDoS, or managed-response products are required.

Review confidence
76/100
Model details
Strengths
  • SmartParse contextual detection plus Network Learning Exchange reputation intelligence can support blocking of malicious and anomalous payloads with system signals and staged controls.
  • The product covers web applications along with REST, SOAP, GraphQL, gRPC, WebSocket, and microservice traffic under one WAF policy model.
  • Deployment options include Fastly edge, Fastly-hosted cloud on eligible routes, on-premises, PaaS, reverse-proxy, module-agent, and Kubernetes patterns for mixed estates.
  • Professional and Premier add account- and workspace-level custom signals plus templated API, account-takeover, and CVE virtual-patch rules that buyers can select and configure.
Cautions
  • Every Essential, Professional, and Premier platform is sold only through custom quote, so buyers cannot validate numeric price, invoice cadence, commitment term, or overage before sales engagement.
  • Essential omits custom signals, templated API/ATO/CVE rules, and advanced rate limiting, so baseline buyers must plan for Professional or Premier when those controls are required.
  • Advanced rate limiting is Premier-only, limited to 15 rules per site or workspace, and uses documented client-identifier constraints that can bound high-volume abuse controls.
  • Fastly Bot Management, adaptive DDoS Protection, automatic API discovery, client-side protection, and 24-hour managed response are separate products or services and are not inherent entitlements of every WAF tier.

Research transparency

How this page was researched

A compact record of the evidence used, what was not tested, and which conclusions still need verification.

Official sources
15
Broad product review sources
2
Marketplace and app-store sources
0
Editorial sources
0
Latest evidence check
Aug 12, 2026
Research basis

Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.

Conflict handling

No unresolved evidence conflict is currently recorded.

View research methodology
Verified findingsNo permanent free Fastly Next-Gen WAF plan or time-limited Fastly Next-Gen WAF trial is publicly stated. The product page offers a demo, which is not a plan or trial.
  • Fastly sells the Essential, Professional, and Premier Next-Gen WAF platforms through sales-assisted quotes. Public sources establish tier and feature boundaries but do not publish a tier-specific amount, currency, priced unit, invoice cadence, minimum purchase, contract duration, renewal term, implementation fee, or usage overage.
  • SmartParse contextual detection for malicious and anomalous request payloads Network Learning Exchange shared reputation and attack intelligence System and custom signals, thresholds, request rules, exclusions, deception, and staged blocking Templated API, account-takeover, and CVE virtual-patch rules on Professional and Premier Premier advanced rate limiting with per-client identification and threshold actions Protection for web applications, REST, SOAP, GraphQL, gRPC, WebSocket, and microservice traffic Edge, Fastly-hosted cloud, On-Prem, PaaS, reverse-proxy, module-agent, and Kubernetes deployment patterns Dashboards, reports, audit logs, APIs, Terraform, simulator, alert integrations, redaction, and optional IP anonymization
  • Requires quote
  • All three exact-product platforms require a quote. Essential is the baseline platform, Professional adds custom signals and templated rules, and Premier adds advanced rate limiting. Fastly also publishes two broader Security package families that include Next-Gen WAF alongside package-specific capacity, support, services, or adjacent products; those bundles are purchase paths rather than WAF plans.
Verification notes and unresolved itemsVerified 2026-08-12 against current public Fastly pricing, product, entitlement, documentation, security-product, and service pages.
  • Essential, Professional, and Premier are retained as the current exact-product platform tiers because current documentation uses those platform names and the January 2026 entitlement page maps them directly to Next-Gen WAF.
  • Security Core, Core Plus, Total, Starter, Advantage, and Ultimate remain related package purchase paths, not plans.
  • Package-bound RPS, workspace, rule, support, DDoS, Bot Management, API Discovery, Edge Rate Limiting, Client-Side Protection, and managed-service entitlements are not generalized to the WAF tiers.
  • Cloud WAF availability is route-dependent, while On-Prem WAF is customer-managed software rather than a hardware or virtual appliance.
Sources checked

Sources checked

Fastly Next-Gen WAF source links

Data storage and privacyFastlyLevel A1Linked to 0 scored claimsChecked Aug 12, 2026
Managed SecurityFastlyLevel A2Linked to 1 scored claimChecked Aug 12, 2026
DDoS Protection SolutionsFastlyLevel A2Linked to 1 scored claimChecked Aug 12, 2026
API Security SolutionsFastlyLevel A2Linked to 1 scored claimChecked Aug 12, 2026
About Bot ManagementFastlyLevel A1Linked to 1 scored claimChecked Aug 12, 2026
Integrations (alerts)FastlyLevel A1Linked to 0 scored claimsChecked Aug 12, 2026
Testing rule logic with the simulatorFastlyLevel A1Linked to 0 scored claimsChecked Aug 12, 2026
Working with advanced rate limiting rulesFastlyLevel A1Linked to 1 scored claimChecked Aug 12, 2026

FAQ

Fastly Next-Gen WAF FAQ

Which Fastly Next-Gen WAF plans are current?

Current documentation and package entitlements identify Essential, Professional, and Premier as Next-Gen WAF platform tiers. Security Core, Core Plus, Total, Starter, Advantage, and Ultimate are broader package names, not WAF plans.

Does Fastly publish Next-Gen WAF prices?

No numeric tier price is public. Fastly directs buyers to contact sales, and public sources do not establish currency, payment timing, minimum purchase, commitment duration, renewal terms, implementation fees, or usage charges.

Can Next-Gen WAF run at the edge, in Fastly's cloud, and on premises?

Yes, but availability differs by route. Edge WAF runs on Fastly's global edge, On-Prem WAF runs in the customer's environment, and Cloud WAF is Fastly-hosted for customers on eligible packaged and legacy-control-panel routes.

Does Next-Gen WAF protect APIs?

Yes. Fastly states that the WAF detects and blocks attacks in SOAP, REST, gRPC, WebSocket, and GraphQL APIs. Automatic API discovery and inventory are separately scoped under Fastly API Security or API Discovery.

Is Fastly Bot Management included in Next-Gen WAF?

No. The WAF includes malicious-bot, credential-abuse, and account-takeover protections, but Fastly Bot Management is a separate product. Its post-cache mode requires both Bot Management and Edge-deployed Next-Gen WAF, and Essential does not support it.

Is Fastly DDoS Protection part of the WAF?

The WAF can use thresholds and rate controls against application-layer abuse, but Fastly DDoS Protection is a separate adaptive product. Selected Security packages may bundle both.

What does Signal Sciences mean in current Fastly documentation?

Signal Sciences is the technology and product lineage behind Fastly Next-Gen WAF. Legacy control-panel terms, API names, and download domains may still appear, but they do not define a separate current plan in this profile. Fastly Legacy WAF is also excluded as a different legacy product.

Does the WAF include 24-hour managed response?

Not as an inherent entitlement of every WAF platform. Response Security and the Managed Security Professional and Enterprise offerings are separate services, although a broader Security package can include a service entitlement.

Popular comparisons

Common Fastly Next-Gen WAF comparisons

Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.

VS #1
Fastly Next-Gen WAFvsAkamai App & API Protector
79Gap 574

Enterprise / Mid-market

VS #2
Fastly Next-Gen WAFvsBarracuda Web Application Firewall
79Gap 079

Enterprise / Mid-market

VS #3
Fastly Next-Gen WAFvsGoogle Cloud Armor
79Gap 277

Enterprise / Mid-market