> But they'll probably check some box for some security audit so they're used. A WAF is useful for when a zero-day is found for that legacy application you jus

> But they'll probably check some box for some security audit so they're used. A WAF is useful for when a zero-day is found for that legacy application you just can't get patches for anymore because the team has "moved on".