Network edge security, defined

Agentic traffic is web and API traffic generated by AI agents acting on someone's behalf, such as AI browsers, shopping assistants or autonomous tools that read pages, fill forms and complete purchases.

API abuse is using an application's APIs in ways they weren't meant to be used, such as scraping data, enumerating accounts, or calling expensive endpoints at high volume, often with valid credentials.

Bot management is identifying automated traffic and deciding how to treat it: allow good bots like search crawlers, challenge suspicious ones, and block malicious ones such as scrapers and credential-stuffing tools.

Business logic abuse is exploiting how an application is designed to work (coupon rules, ticket queues, sign-up bonuses, inventory holds) rather than a technical vulnerability.

A content delivery network (CDN) is a global network of servers that caches and serves web content close to users, and increasingly hosts security controls such as WAFs and bot detection.

Credential stuffing is an automated attack that tries large lists of stolen username and password pairs on a login page, betting that people reuse passwords across sites.

Custom WAF rules are rules a security team writes for its own applications, such as blocking a path, limiting a country, or allowing a trusted partner's IP range.

Edge security posture management is the continuous measurement of how well edge controls protect each application: what's covered, what's misconfigured, and what's being missed.

Exposure management is the practice of finding which vulnerabilities are actually exploitable in production and shrinking the exposure window, the time between when a flaw becomes exploitable and when it is blocked or fixed.

A WAF false negative is a malicious request the WAF lets through because no rule matched it, or because the matching rule was disabled or set to log only.

A WAF false positive is a legitimate request that the WAF blocks or flags as an attack, such as a real customer's checkout, login or form submission.

A Layer 7 (application-layer) DDoS attack floods an application with requests that look legitimate, such as page loads, searches or API calls, to exhaust servers or run up costs.

In log mode (also called count, detect or simulate mode) a WAF rule only records matching requests; in block mode it stops them.

Managed WAF rules are rule sets written and updated by the WAF vendor (or a project like the OWASP Core Rule Set) to block common attacks without the customer writing rules themselves.

The network edge is the boundary where internet traffic first reaches an organization's applications, through CDNs, WAFs, load balancers, API gateways and DNS.

Network Edge Security Management (NESM) is the practice of measuring, tuning and governing all edge security controls (WAFs, CDNs, bot tools, edge rules) as one system instead of vendor by vendor.

Policy lifecycle automation is the process of testing, deploying, versioning and rolling back edge security rules automatically, instead of editing them by hand in each vendor's console.

Remote code execution (RCE) is a vulnerability that lets an attacker run their own code on a server by sending a crafted request, usually giving them full control of the application.

WAF rule tuning is adjusting rules to fit a specific application: narrowing rules that block legitimate traffic, adding exceptions carefully, and tightening rules where protection is missing.

A subdomain takeover happens when a DNS record still points to a service the company no longer controls (a deleted cloud app, an expired storefront), letting an attacker claim that service and serve content on the company's subdomain.

Virtual patching is blocking the exploitation of a known vulnerability at the WAF or edge, before the application code itself is fixed.

A WAF bypass is any way for traffic to reach an application without being inspected by the WAF, such as an exposed origin server, an unprotected subdomain, or a payload the rules can't parse.

WAAP (Web Application and API Protection) is the category of cloud services that combine a WAF with bot management, API security and Layer 7 DDoS protection.

A web application firewall (WAF) inspects HTTP requests to web applications and APIs and blocks those that match attack patterns, such as SQL injection, cross-site scripting or known exploits.