Web Application Firewalls Are Broken And Everyone Knows It

Huskeys emerged from stealth with an $8 million seed round to sell an Edge Security Management control plane that sits atop existing WAFs and manages rule configuration for customers including TikTok, Merlin Entertainments, and Hugging Face. The article argues the enforcement layer of WAFs is adequate but the control plane—rule creation, maintenance, and orchestration—is broken due to static rules and limited organizational capacity. AI-driven automation is presented as a partial solution (posture management, rule generation, orchestration) but with caveats around applying the right AI types and data residency/compliance risks. The piece frames this as an industry shift rather than a single-vendor story, with startups focusing on integration rather than replacement.

Analysis

The market is separating enforcement from orchestration: vendors that monetize orchestration without forcing rip-and-replace win faster adoption inside large enterprises. That creates a two-way revenue effect — a permanent lift to third-party control-plane vendors' ARR and a simultaneous compression of professional-services upsell for incumbent enforcement providers, pressuring near-term margins. Enterprises will tolerate incremental spend for a management layer that reduces application downtime and false positives, so expect migration to be steady (measured procurement waves of 5–15% of an organization’s security budget per year) rather than binary.

Adoption timing and regulation are the main pacing factors. Real enterprise uptake will play out over 6–24 months as proof points accumulate within regulated verticals; however, privacy and data-residency constraints will bifurcate the market — cloud providers able to offer on-prem or private-model control planes will capture regulated customers, while startups that require routing traffic to third-party AI models will see growth limits. A single major regulatory clarification on whether production traffic can be evaluated by external generative models would flip adoption curves in months, not years.

Competitive second-order effects matter: incumbents with broad edge portfolios (CDN + security + orchestration) have leverage to bundle control planes and lock customers, while pure-play enforcement vendors face higher churn if they can’t match managed orchestration. The contrarian angle is that Big Cloud can neutralize the startup wave quickly by embedding a free/low-cost control-plane feature into existing contracts — meaning the value accrues to platform owners unless startups prove indispensable through differentiated data or execution within 12–18 months.

Key Decisions for Investors

• Long AKAM (Akamai) — buy shares or 12-month at-the-money calls. Thesis: edge-integrated control-plane demand should lift growth and rerate multiples if Akamai converts even a mid-single-digit percentage of large enterprise WAF spend. Timeframe: 6–12 months. Risk/reward: target +20–35% upside; use a 12% stop loss to limit execution risk from a slow enterprise sales cycle.
• Short NET (Cloudflare) — establish a 3–9 month short or buy puts sized to 25–50% of a directional allocation. Thesis: third-party overlays and margin pressure from loss of professional-services upsell could depress near-term margins and revenue cadence. Timeframe: 3–9 months. Risk/reward: downside target 15–25%; cap losses with a 10% stop or buy protective calls to convert to a defined-risk collar.
• Pair trade: long AKAM / short NET equal notional — use options to define risk (buy AKAM calls and NET puts). This isolates security-control-plane adoption vs. pure enforcement exposure and improves R/R to ~2:1 if the consolidation/bundling narrative plays out. Timeframe: 6–12 months. Exit triggers: AKAM announces enterprise control-plane wins or NET publishes an upsell-heavy professional-services beat.
• Event conditional: monitor AWS (AMZN) roadmap for a managed control-plane announcement. If AWS signals an integrated managed offering within 4 months, buy short-dated AMZN calls (3–6 months) to capture a platform-led consolidation rally; if not, remain neutral on AMZN security exposure.