The Tireless Guardian: Agentic AI and the Art of WAF at Scale

The Tireless Guardian: Agentic AI and the Art of WAF at Scale

Speakers: Ammar Alim

Conference: fwd:cloudsec

YouTube: https://www.youtube.com/watch?v=k8bqDHfkvEw

Overview

In his fwd:cloudsec talk, "The Tireless Guardian: Agentic AI and the Art of WAF at Scale," Ammar Alim from Adobe presents a compelling case for leveraging agentic AI to revolutionize the deployment and management of Web Application Firewall (WAF) rules. This session addresses the escalating challenges faced by security organizations in an era of exploding software vulnerabilities and increasingly sophisticated, AI-augmented attacks. Alim argues that traditional patching mechanisms are no longer sufficient, highlighting a critical need for rapid, automated defenses at the network edge.

The core of Alim’s presentation is a detailed exposition of an innovative, AI-driven system designed to detect new vulnerabilities, generate WAF rules across multiple vendors, and validate their effectiveness in minutes, rather than days or weeks. This approach aims to provide security teams with crucial "leverage" – the ability to implement immediate, widespread protection against zero-day threats like Log4j, thereby buying invaluable time for developers to implement permanent code fixes. The talk underscores a significant philosophical shift in WAF utility, moving beyond its traditional role in mitigating common web application flaws to becoming a dynamic, first-line defense against emergent, high-impact vulnerabilities.

This talk is particularly pertinent for cloud security architects, engineering managers, and CISO-level professionals grappling with the overwhelming pace of modern cyber threats. Alim’s insights offer a practical, scalable framework for enhancing an organization's defensive posture, emphasizing automation and strategic application of AI to maintain security accountability without overburdening development teams. It's a vision for how security organizations can proactively stay ahead of the curve in a landscape increasingly defined by AI-powered offense and defense.

Background

▶ Watch: Escalating threat landscape: exploitable vulnerabilities increasing (2:00)

The impetus for Ammar Alim's work at Adobe, and for this talk, stems from a confluence of alarming trends in the cybersecurity landscape and a personal "aha!" moment. Alim recounts his initial disinterest in WAFs during his earlier career in cloud security, focusing instead on VPC, S3, and IAM. However, the Log4j vulnerability in December 2021, while he was an engineering manager at Frame.io (later acquired by Adobe), served as a stark awakening. His team's WAF was instrumental in blocking Log4j exploits, providing a critical buffer during the holiday season when patching was impractical. This experience transformed his perspective, shifting his focus from internal developer-induced issues to external, attacker-driven threats, and solidifying his belief in the strategic value of WAFs.

The broader context for this shift is dire. According to the 2026 Verizon Data Breach Investigations Report, exploitable vulnerabilities are now the number one ingress point for attackers, with AI significantly accelerating vulnerability discovery and exploitation. NIST is reportedly falling behind in analyzing CVEs, indicating a systemic inability to keep pace. Software vulnerabilities account for 30% of breaches, and a staggering 74% of known exploitable critical vulnerabilities went unfixed in 2025. The average time to patch a vulnerability has increased to approximately 40 days, up from 30. This creates a critical window of exposure, exacerbated by attackers now leveraging AI across 15 phases of attack, from recon to exploitation.

The sheer volume of vulnerabilities is also exploding. Alim cites research indicating an 8-10x increase in exploitable vulnerabilities, from 69 million in 2022 to an projected 527 million in 2025. Coupled with the rise of "Vulnerability as a Service" (VaaS) and the ease with which non-traditional developers (product leaders, CEOs) can now ship software using AI-generated code and third-party libraries, the attack surface is expanding rapidly and unpredictably.

To address these challenges, Alim outlines a foundational framework for scaling security solutions within large organizations:

1. Security isn't everyone's job: Expecting all engineers to be security experts is unrealistic and ineffective. Security teams must own their domain, be accountable, and deliver solutions.
2. A central team cannot grow with the business: Security teams must scale sub-linearly, meaning they cannot simply add more people to keep up with business growth. Automation and leverage are essential.
3. Make the safe path the easy path: Security solutions must be frictionless and widely adoptable. Complicated secure processes will be bypassed.
4. Automate the boring stuff: Repetitive tasks must be automated to free up human expertise for higher-value problems.
5. You cannot protect what you cannot see: Comprehensive visibility into all public-facing assets and their security posture is non-negotiable.
6. Ability to make changes quick is your best security control: Speed is paramount. Solutions must enable rapid response to emerging threats.
7. Address the problem at the core: WAFs should not compensate for poor software engineering practices (e.g., SQL injection, XSS should be addressed in frameworks), but rather serve as an emergency measure for novel threats.

This philosophy culminated in Adobe's development of an agentic AI system for WAF management, providing the necessary "leverage" for security teams to act decisively and independently, without relying solely on developer patching cycles.

Key Findings

▶ Watch: Adobe's challenge: patching cannot keep up with vulnerabilities (6:00)

The central finding of Ammar Alim's talk is the successful implementation of an agentic AI system that dramatically accelerates the deployment of Web Application Firewall (WAF) rules for zero-day vulnerabilities, shifting response times from weeks or days down to mere minutes. This capability directly addresses the critical gap between the rapid emergence of new threats and the slow pace of traditional patching cycles.

Key findings and contributions include:

• Rapid Zero-Day Mitigation: The system enables security teams to deploy effective WAF rules as a virtual patch against newly discovered, actively exploited vulnerabilities with unprecedented speed. This provides a crucial window for developers to implement permanent code fixes, especially during periods when patching is impractical (e.g., holiday freezes, critical business periods).
• WAF as a Strategic Leverage Point: Alim demonstrates that WAFs, traditionally used for known issues like SQL injection and cross-site scripting, can be transformed into a powerful, proactive defense mechanism for zero-days. This redefines the WAF's role from a compensatory control for bad coding practices to an essential emergency response tool.
• Scalability for Diverse Environments: Adobe, a company that grows significantly through acquisition, faces the challenge of managing diverse technology stacks and multiple WAF vendors (e.g., AWS WAF, Akamai, Cloudflare, ModSecurity). The agentic AI system successfully tames this complexity, generating vendor-specific rules at scale.
• Near-Zero False Positives: A significant achievement of the system is its ability to generate WAF rules with "almost zero false positives." This is crucial for maintaining business continuity and customer trust, especially when deploying automated defenses in production environments.
• Automated Contextual Intelligence: The system automates the laborious process of gathering comprehensive context around a CVE – from public advisories to internal asset ownership, application IDs, and code repositories. This rich, dynamic context is vital for the AI to generate precise and effective rules.
• Self-Learning and Continuous Improvement: The agentic architecture incorporates a feedback loop where the system learns from each new CVE, identifying gaps, improving rule generation, and enhancing its overall effectiveness over time. This creates a continuously improving security posture.
• Human-in-the-Loop Optimization: While highly automated, the system intelligently integrates a human for a minimal, high-leverage role (approximately 1 hour for final validation in shadow mode). This balances automation speed with accountability and human oversight for critical production changes.
• Shift in Security Philosophy: The project embodies a fundamental shift in how security operations can scale. By providing security teams with automated leverage, it empowers them to take direct action against threats, aligning with the principle that security is a specialized, accountable function rather than a diffuse responsibility.

These findings collectively present a robust, scalable, and highly effective model for modern security operations, particularly in large, dynamic cloud environments.

Technical Deep Dive

▶ Watch: Leveraging AI to make WAFs smarter for faster protection (6:26)

The Adobe agentic AI system for WAF rule generation is an intricate, multi-stage pipeline designed for extreme speed and accuracy. Alim walks through a "dense diagram" outlining the end-to-end process, which can be broken down into several interconnected phases, orchestrated by various agents and event-driven mechanisms.

1. Vulnerability Discovery (Phase 1)

• Mechanism: A deterministic Lambda function acts as a cron job, scanning the internet every 15 minutes.
• Sources: It fetches new CVEs from reputable sources like GitHub Advisory and NVD (National Vulnerability Database), as well as security research blogs (e.g., Whiz, Rapid7).
• Goal: To be aware of any new vulnerability as fast as possible.

1. Deep Research and Triage (Phase 2)

• Deep Research Agent: Upon discovering a new CVE, a specialized Deep Research Agent (powered by an LLM) is invoked. This agent scours the internet for detailed information about the vulnerability, including specific parameters, headers, and exploit nuances. The goal is to gather as much clean context as possible to avoid relying solely on the LLM's general training data.
• State Management: The CVE ID and its research findings are stored in a DynamoDB table. This acts as a state table, preventing the system from reprocessing the same vulnerability multiple times.
• Triage: The system then triages the vulnerability to confirm it is actually exploitable and relevant to Adobe's environment. It integrates with existing security tools (e.g., Wiz) to scan Adobe's assets and determine if the vulnerability applies. If not, the process for that CVE halts.

1. Impact and Ownership Context (Phase 3)

• Enrichment: If the CVE is relevant, the system enriches the context with internal Adobe-specific information. This includes identifying the owner of the impacted host or application, its app ID, associated Git repositories, and other critical metadata. This helps understand the blast radius and accountability.
• WAF Coverage Check: A crucial step is to verify if a WAF is already in front of the impacted service. If not (e.g., for an AWS WAF scenario), the system can quickly spin up a Web ACL. For other vendors like Akamai or Cloudflare, it might trigger a conversation for manual setup or contract adjustments, or prompt the deployment of a sidecar WAF like ModSecurity.
• Reachability: The system also determines if the affected service is publicly exploitable or resides in a private subnet. If it's not internet-facing, a WAF rule might be unnecessary, and the focus would shift directly to patching.

1. Dynamic Agent Context Building (Phase 4)

• Throughout the previous steps, a supervising agent continuously documents and tracks all findings. This dynamic process builds a comprehensive agent context for the rule-generating LLM, incorporating environmental details, owner information, code-base nuances from scanned Git repos, and insights from CloudWatch logs. Up to this point, the direct use of AI for rule generation is minimal; its primary role is deep research and intelligent documentation.

1. Rule Generation Preparation (Phase 5)

• LLM Orders (Prompt): To generate WAF rules, the system provides the LLM with clear, textual instructions or "orders" (the prompt).
• Avoiding False Positives and Bypasses: Two key concerns for WAF rules are blocking legitimate traffic (false positives) and being circumvented (bypasses). For zero-day issues, Alim emphasizes prioritizing the reduction of false positives over bypasses. This is because opportunistic attackers often use known, specific exploits, making overly broad rules more detrimental to legitimate users than the risk of a highly skilled attacker meticulously crafting a bypass.
• Test Generation (TDD Approach): Based on the detailed context from the deep research, the system automatically generates a comprehensive suite of tests. Applying a Test-Driven Development (TDD) approach, these tests specifically target known exploit vectors, potential bypasses, and expected legitimate traffic, ensuring a high-quality rule.

1. Rule Generation (Phase 6)

• LLM Invocation: The accumulated context, the prompt, and the test cases are fed to an LLM (specifically AWS Bedrock in Adobe's case, though any capable AI platform could be used).
• Multi-Vendor Output: The LLM generates WAF rules tailored for multiple vendors (e.g., AWS WAF, Akamai, Cloudflare), translating the core logic into vendor-specific syntax.

1. Local Validation (Phase 7)

• Pre-Deployment Testing: Before deploying to a live environment, rules undergo rigorous local validation.
• ModSecurity Container: A ModSecurity WAF container is spun up locally.
• Attack & Normal Traffic: The system uses a container to simulate attacks against a vulnerable environment and another to simulate normal customer-like traffic.
• Metrics: It measures the evasion rate (how easily the rule can be bypassed) and the rate of blocking legitimate traffic.
• Linting: The rules are also linted to ensure correct syntax and prevent deployment errors (e.g., CloudFormation errors in AWS).
• Feedback Loop: If the rule doesn't meet quality standards, the system loops back, gathering error details (documented by another agent) to refine the rule generation process.

1. Live Testing in Private VPC (Phase 8)

• Production-Grade WAF: Once local tests pass, the rule is promoted to a production-grade WAF (e.g., AWS WAF) deployed in a private VPC.
• Vulnerable Environment: A vulnerable environment, specifically configured with the CVE, is spun up within this private VPC.
• Lambda-Driven Attacks: A Lambda function is used to attack this vulnerable environment, both with and without the WAF rule enabled.
• Logging and Analysis: Extensive logs are captured in CloudWatch. Agents then fetch and analyze these logs, documenting the rule's performance for each test case:
• Malicious traffic blocked (good).
• Malicious traffic allowed (bad).
• Legitimate traffic blocked (bad – false positive).
• Legitimate traffic allowed (good).
• Iterative Improvement: This live testing phase provides critical feedback, leading to further refinement of the rule and the generation process.

1. Self-Learning and Confidence Building (Phase 9)

• Supervising Agent: An overarching agent monitors the entire pipeline, documenting findings and performance for each rule.
• Evidence Bundle: A complete "evidence bundle" detailing the rule's performance, logs, and test results is checked into Git for historical tracking. This allows the system to analyze its own performance over time, identify patterns, and continuously improve its rule generation and validation logic. The system is designed to be self-learning, finding gaps with each new CVE.

1. Production Deployment (Shadow Mode) (Phase 10)

• Staged Rollout: Rules are not immediately deployed in blocking mode in production. Instead, they are initially deployed in shadow mode (or alert mode).
• Traffic Observation: In shadow mode, the WAF observes production traffic and makes decisions (block/allow) but does not enforce them. This allows the security team to gain confidence that the rule correctly identifies malicious traffic without impacting legitimate users.
• Human Validation: After observing consistent performance (blocking bad, allowing good) in shadow mode, a human engineer spends approximately 1 hour to validate the rule and flip the switch to block mode. This minimal human intervention ensures accountability and confidence in the AI-driven system.

Challenges Encountered by AI: Alim notes that the AI sometimes generated rules that were:

• Too broad: Catching legitimate traffic due to overly permissive regex.
• Too narrow: Easily bypassed by attackers.
• Hallucinations: Inventing incorrect syntax or logic.
• Expensive: Generating rules that consume too many WCU (AWS WAF Capacity Units), leading to higher costs or deployment issues. Workflows and checks were implemented to catch these issues.

The system's success lies in its orchestrated blend of AI-powered research and generation with deterministic validation steps, ensuring rapid, reliable, and scalable WAF protection.

Demo / Proof of Concept

▶ Watch: Talk's origin: healthy debate on WAF effectiveness (7:10)

While the talk did not feature a live, interactive demonstration of the agentic AI system generating and deploying a WAF rule in real-time, Ammar Alim extensively detailed the rigorous, multi-stage validation process that serves as a robust proof of concept for the system's effectiveness.

The core of this "proof of concept" lies in the automated testing phases:

1. Local Validation: Before any rule approaches a production environment, it undergoes comprehensive testing in a local containerized setup. This involves deploying the AI-generated rule within a ModSecurity WAF container and simulating both legitimate user traffic and known exploit attempts against a vulnerable application container. The system meticulously measures the evasion rate (how often an attack bypasses the rule) and, critically, the false positive rate (how often legitimate traffic is blocked). This initial stage confirms the rule's basic functionality and adherence to quality standards.

1. Live Testing in a Private VPC: For a more realistic assessment, rules are then deployed to a production-grade WAF (e.g., AWS WAF) within an isolated private VPC. Here, a specifically vulnerable environment (containing the target CVE) is spun up. A Lambda function orchestrates a series of attacks and benign requests against this environment, with and without the WAF rule active. The system captures detailed CloudWatch logs to analyze the WAF's behavior, verifying that malicious traffic is blocked and legitimate traffic is allowed, without unintended side effects. This phase provides high confidence in the rule's performance under conditions closely mimicking production.

1. Shadow Mode Deployment: The final stage of validation before full enforcement in production is deploying the rule in shadow mode (alert-only). In this phase, the WAF observes actual production traffic and logs its decisions (block/allow) without taking any active enforcement action. This allows the security team and the supervising AI agent to monitor the rule's real-world impact, ensuring it consistently identifies malicious patterns while allowing legitimate customer traffic to pass unimpeded. Only after this extended observation period, typically with a minimal human review, is the rule switched to active blocking mode.

These integrated validation steps, from local simulation to live testing in isolated environments and non-enforcing production observation, collectively demonstrate the system's capability to generate and deploy high-quality, effective WAF rules rapidly and reliably, without the need for a live, ad-hoc demonstration during the talk itself. The speaker emphasized the "almost zero false positive" rate achieved through this meticulous validation, underscoring the system's practical success.

Defensive Implications

▶ Watch: Log4j crisis highlights critical value of WAF (8:55)

The agentic AI WAF system presented by Ammar Alim offers profound defensive implications for organizations, particularly those operating at scale in dynamic cloud environments. This approach moves beyond traditional reactive security measures to embrace a proactive, automated, and intelligent defense strategy.

1. Rapid Zero-Day Mitigation: The most significant implication is the ability to deploy virtual patches against zero-day vulnerabilities in minutes, rather than days or weeks. This drastically shrinks the window of exploitation, providing immediate protection against critical threats like Log4j, which often emerge during inconvenient times (e.g., holidays) when traditional patching is delayed. This buys invaluable time for development teams to implement permanent code fixes.

1. Enhanced Security Leverage and Accountability: The system provides security teams with direct leverage to enforce protections without requiring immediate code changes or deployments from development teams. This aligns with Alim's philosophy that "security isn't everyone's job" and empowers central security teams to be accountable for rapid threat response, even when they cannot scale linearly with the business.

1. Proactive Threat Intelligence and Contextual Awareness: By automating the discovery and deep research of CVEs, organizations gain immediate and comprehensive intelligence on emerging threats. The system's ability to dynamically enrich this with internal context (owner, app ID, WAF coverage) ensures that defensive actions are targeted and relevant to the specific environment. This addresses the challenge of "you cannot protect what you cannot see."

1. Shift in WAF Strategy: The talk advocates for a philosophical shift in WAF utilization. Instead of primarily compensating for known, preventable issues (like SQL injection or cross-site scripting, which should be addressed at the code framework level), WAFs become a critical emergency response tool for novel, high-impact vulnerabilities. This refocuses security efforts on addressing threats at their root and using the WAF for its highest leverage.

1. Reduced Operational Burden and Scalability: Automating the entire WAF rule lifecycle – from discovery and research to generation, validation, and deployment – significantly reduces the manual burden on security engineers. This enables central security teams to scale their defensive capabilities sub-linearly, keeping pace with business growth and the explosion of software, without needing to hire proportionally more staff.

1. Continuous Improvement and Self-Learning Defense: The system's self-learning feedback loop, where past performance informs future rule generation and validation, means that the defensive posture continuously improves. Each new CVE processed enhances the system's intelligence and accuracy, making it more resilient over time. The storage of "evidence bundles" in Git allows for historical analysis and reasoning about rule performance.

1. High Confidence, Low False Positives: The multi-stage validation process (local testing, live testing in private VPCs, and shadow mode in production) is designed to ensure generated rules are highly effective at blocking malicious traffic while maintaining "almost zero false positives." This is crucial for avoiding business disruption and maintaining customer trust, which is often a major concern with automated security controls.

1. Standardization Across Diverse Stacks: For organizations like Adobe with multiple acquired companies and diverse technology stacks, the system standardizes the WAF response across different vendors (AWS WAF, Akamai, Cloudflare, ModSecurity), ensuring consistent protection regardless of the underlying infrastructure.

In essence, this agentic AI WAF system provides a blueprint for a more agile, intelligent, and scalable security operation, allowing defenders to proactively counter the increasing speed and volume of cyber threats in the age of AI.

Key Takeaways

• Agentic AI for WAF is a Game-Changer for Zero-Days: By automating the discovery, research, rule generation, and validation processes, agentic AI can reduce the time to deploy WAF rules for zero-day vulnerabilities from weeks to mere minutes, providing critical "virtual patching" capabilities.
• WAFs Provide Essential Security Leverage: In an environment where patching is slow (40+ days) and central security teams cannot scale linearly, WAFs offer a direct, independent mechanism for security organizations to implement immediate protections, buying crucial time for permanent fixes.
• Comprehensive Multi-Stage Validation is Non-Negotiable: To achieve high confidence and near-zero false positives, AI-generated WAF rules require rigorous local testing (e.g., ModSecurity container), live testing in isolated environments (private VPC with vulnerable services), and deployment in production shadow mode before full enforcement.
• AI Should Augment, Not Fully Replace, Deterministic Systems: The most effective use of AI in this context is to fill gaps, automate deep research, and assist with verification, rather than generating entire solutions from scratch. The core pipeline should remain largely deterministic, with AI providing intelligent context and rule refinement.
• Prioritize False Positives Over Bypasses for Zero-Days: When crafting WAF rules for zero-day exploits, it's generally more critical to avoid blocking legitimate customer traffic (false positives) than to achieve absolute bypass prevention, as opportunistic attackers often use known, specific attack patterns.
• Scaling Security Requires Automation, Context, and Accountability: Effective security at scale depends on automating repetitive tasks, building dynamic contextual intelligence about assets and vulnerabilities, and recognizing that security is a specialized, accountable function that must be empowered to act decisively.

About the Speaker(s)

Ammar Alim is a security engineering leader with a background in cloud security. From 2013 to 2021, he worked on various aspects of cloud security, including VPC security, data security, and creating IAM policies, primarily focusing on internal cloud infrastructure. His perspective on Web Application Firewalls (WAFs) dramatically shifted in 2021 after the Log4j vulnerability, when he was an engineering manager at Frame.io (a company later acquired by Adobe). This experience highlighted the critical role WAFs could play in providing immediate protection against severe zero-day threats. Currently, Ammar works at Adobe, where he leads the team responsible for developing and implementing the agentic AI WAF system discussed in his talk. Beyond his work at Adobe, he is actively involved in the security community, running the OWASP Seattle chapter.