Services and use cases

Risk Mitigation Score (RMS) determines your “Security Value Zone,” where negative values indicate poor security practices, while positive values reflect investments in effort, tools, and effective incident response.

Assessment of Enforcement Levels

Assessment measure the current “Enforcement” level, predicting how effectively you can prevent the next attack when incident response is triggered.

Assessment of Security Exposure

Assessment also measure “Security Exposure,” highlighting reductions in protection levels and identifying limitations critical to effective incident response.

Security Controls Assessment (SCA)

Purpose: Evaluate WAF’s ability to detect and mitigate known attack techniques.
Tests Include:

• Signature effectiveness (XSS, SQLi, RCE, etc.)

• Custom payload detection

• Evasion technique handling

• Entity-level protection (parameters, headers)

• Policy tuning gaps
  Outcome: Risk Mitigation Score (RMS) for control coverage.

Bot Protection Assessment

Purpose: Evaluate how WAF handles automated threats.
Tests Include:

• OWASP Automated Threats (carding, scraping, credential stuffing)

• Bot client simulation (headless browsers, replay tools)

• CAPTCHA and JS challenge handling
  Outcome: Bot defense score and bypass feasibility.

Policy Configuration Analysis

Purpose: Validate WAF policy logic and alignment to application behavior.
Tests Include:

• Policy enforcement review

• Positive security model checks

• Custom rules review (regex, IP, Geo)
  Outcome: Policy quality score and hardening recommendations.

Custom Use Case Simulation

Purpose: Validate WAF in real-world incident scenarios.
Tests Include:

• Simulated red team campaigns

• Attack chain testing (multi-step exploit)

• Application-specific threat modeling
  Outcome: Application-aware mitigation score.