baselineRFIDoes the platform provide a positive security model (allow-list known-good behavior) in addition to negative/signature-based rules, and how is the positive model trained/maintained without excessive false positives?weight 3
Answer key — what a strong answer shows
A positive security model catches novel attacks signatures miss, but requires real tuning discipline — look for a described training/learning process, not just 'AI-powered.'
baselineRFPDescribe DDoS mitigation capacity (stated Tbps/Gbps absorption) and time-to-mitigate for a volumetric attack, backed by a real customer incident, not just a marketing capacity number.weight 3
Answer key — what a strong answer shows
Look for a real incident with a measured time-to-mitigate, since stated capacity numbers are often theoretical network-wide totals, not per-customer guarantees.
baselineRFIHow does the platform handle Layer 7 application-layer DDoS (e.g., HTTP flood mimicking legitimate user behavior) distinct from volumetric Layer 3/4 attacks?weight 3
Answer key — what a strong answer shows
L7 attacks are much harder to distinguish from real traffic — look for a specific behavioral/rate-based methodology, not just volumetric capacity.
baselineRFIWhat is the false-positive rate on legitimate traffic, and what mechanism exists for rapid emergency rule tuning during an active attack without taking the application offline?weight 3
Answer key — what a strong answer shows
Look for a stated false-positive figure and an emergency-tuning workflow that doesn't require a lengthy change-management process during a live incident.
baselineRFPDetail bot management capability — can the platform distinguish malicious automated traffic (credential stuffing, scraping, inventory hoarding) from legitimate bots and from real users, and what accuracy figure does the vendor cite?weight 3
Answer key — what a strong answer shows
Strong answers give a real accuracy/detection figure and explain the fingerprinting/behavioral methodology, not just 'bot protection included.'
baselineRFIDoes the platform provide API-specific protection (schema validation, API-specific rate limiting, detection of business-logic abuse) distinct from generic web-app WAF rules?weight 3
Answer key — what a strong answer shows
APIs have different attack surfaces than traditional web apps — look for API-specific capability, not a WAF ruleset repurposed without adaptation.
baselineRFPExplain the deployment model (reverse proxy/CDN-edge, inline appliance, or cloud-native/sidecar) and the added latency it introduces to legitimate traffic under normal load, with a customer-measured figure.weight 3
Answer key — what a strong answer shows
Look for a real measured latency figure from a customer, not a lab benchmark, since edge/CDN deployment models have very different latency profiles than inline appliances.
baselineRFIHow are WAF rules kept current against newly disclosed web application vulnerabilities (e.g., a new CVE in a popular CMS or framework), and what is the typical time from CVE disclosure to a protective rule being available?weight 3
Answer key — what a strong answer shows
Strong answers state a concrete time-to-rule figure; a WAF with stale rule coverage provides false confidence against current threats.
baselineRFIWhat is the pricing model — per request volume, per protected application, or a flat enterprise tier — and how does cost scale during a large legitimate traffic spike (e.g., a viral marketing event) versus during an actual DDoS attack, given both look similar in raw volume?weight 3
Answer key — what a strong answer shows
This is a genuine pricing tension specific to this category — ask explicitly how the vendor distinguishes and prices for legitimate traffic spikes versus attack traffic, since a naive volume-based pricing model could penalize a customer for their own successful marketing campaign.
baselineRFPDetail multi-CDN or multi-cloud deployment consistency — can protection policy be applied uniformly if the customer runs applications across multiple CDN providers or cloud regions, or does coverage/policy fragment across each deployment?weight 3
Answer key — what a strong answer shows
Look for a unified policy management layer across multi-CDN/multi-cloud deployments; fragmented, separately-managed policy per deployment is a real operational risk and consistency gap.
baselineRFIDoes the platform satisfy PCI DSS's WAF requirement specifically (either the 'automated technical solution' or manual code-review alternative), and can the vendor provide documentation an assessor will actually accept as sufficient evidence?weight 3
Answer key — what a strong answer shows
PCI compliance is a specific, checkable requirement — ask for real documentation/evidence that's been accepted by a QSA (Qualified Security Assessor) before, not just a generic 'PCI compliant' marketing claim.
baselineRFPExplain the emergency-support SLA during an active attack — what is the guaranteed response time to reach a live human during a genuine incident, and is this support tier included in the base subscription or a paid add-on?weight 3
Answer key — what a strong answer shows
Strong answers give a concrete, contractual response-time SLA and are explicit about whether emergency support requires a premium tier — during an active DDoS attack, minutes matter and self-service documentation isn't sufficient.
baselineRFIHow does the platform integrate with the customer's SIEM/SOC for correlated visibility — is WAF/DDoS event data exported in real time for correlation with other security telemetry, or does it remain siloed in the vendor's own dashboard?weight 3
Answer key — what a strong answer shows
Real-time export for SIEM correlation is materially more useful for a mature security team than data siloed in a separate vendor dashboard requiring manual cross-referencing.
baselineRFIDoes the platform provide mobile-app-specific protection (API abuse targeting mobile backends, mobile-app-specific bot/automation detection) distinct from generic web-application WAF rules built for browser traffic?weight 3
Answer key — what a strong answer shows
Mobile-app backend traffic patterns differ meaningfully from browser-based web traffic — a vendor should clarify whether mobile-specific protection is a real, distinct capability or an afterthought.
baselineRFPDetail whether rule tuning is a self-service capability the customer's own team performs, or a managed service the vendor's team handles — and if managed, what is the typical turnaround time for a rule-tuning request during normal (non-emergency) operations?weight 3
Answer key — what a strong answer shows
Look for clarity on the self-service-versus-managed model and a concrete non-emergency turnaround time; a customer without deep WAF expertise may specifically need (and should budget for) the managed-service option.
baselineRFIWhat historical attack-trend reporting is available for executive/board audiences — can the platform show attack volume and blocked-threat trends over quarters, suitable for demonstrating security posture and ROI to non-technical stakeholders?weight 3
Answer key — what a strong answer shows
Trend-over-time reporting suitable for board audiences is a distinct capability from a real-time technical dashboard built for security engineers — confirm this exists as a maintained, exportable report.
baselineRFPVendor should have a tool capable of monitoring, detecting and managing incidents for database security events (access to sensitive/PII data, database logins with client IP/server IP/source program info, admin command auditing) and IT infrastructure security events (buffer overflow, port/vulnerability scans, password cracking, worm/virus outbreak, unauthorized firewall rule changes, SQL injection, XSS, layer 7 web attacks) via integration with the WAF/Firewall solution deployed at the financial institution.weight 3
baselineRFPConduct a comprehensive analysis of existing applications, application development and testing practices, and tools (e.g. HP Fortify, F5 Web Application Firewall) from a security standpoint and provide detailed findings and recommendations.weight 3
baselineRFPDemonstrate configuration, support, and architectural design experience with AppDynamics, Azure Application Insight, HP Fortify, F5 Web Application Firewall, Checkpoint Next-Generation Firewalls, Microsoft SQL databases, and cloud/hybrid/on-premise application platforms in an enterprise environment.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
