The title sounds misleading to me; this paper is about evading the set of WAFs which may include the universal set at this point in time, and further only including specific versions and rulesets of those WAFs. I don&#x27;t know...the title made me think &quot;well, then why bother using a WAF at all?&quot;, the paper actually implies that I should use a WAF as one line of defense, but I don&#x27;t think anyone ever got the warm fuzzies thinking their app was fully protected behind a WAF.<p>If the game is to survive the bear, I don&#x27;t have to out-run the bear, I need to out-run you. A WAF is a nice pair of sneakers against your flip flops--doesn&#x27;t help me much if my legs are broken.