Guides
Practical guides for protecting modern surfaces
Step-by-step paths for the things teams actually do — protect a web app, secure an API, defend agent endpoints, and reach blocking safely.
By task
Start with your surface
Protect a web app with a WAF
Point a domain at the edge and reach blocking without breaking real traffic.
Learn more Secure an API
Schema, token, and abuse controls for public, partner, and internal APIs.
Learn more Protect AI-agent endpoints
Identity-aware enforcement for agent-to-app and tool traffic.
Learn more Onboard SaaS custom domains
Per-tenant isolation and API-first onboarding at scale.
Learn more Move from detect to block
Tune safely with anomaly scoring, scoped exclusions, and simulate mode.
Learn more Keep keys out of the WAF
How enforcement references certificates without ever holding a key.
Learn more From the blog
Deep dives and background reading
20 May 2026
Multi-tenant WAF architecture
Multi-tenancy is an architecture decision, not a feature flag. Here is how tenant isolation, policy versioning, and event-driven config fit together.
Learn more 29 Apr 2026
OWASP CRS for enterprise WAF
OWASP CRS gives you a transparent, community-vetted detection baseline. Used well, it is how enterprises tune from detect to block with confidence.
Learn more 8 Apr 2026
Protecting AI-agent endpoints
Agentic workflows generate machine-to-machine traffic at scale. Protecting those endpoints needs identity-aware enforcement, not just rate limits.
Learn more 18 Mar 2026
Why a WAF should not own private keys
Putting private keys in the WAF layer concentrates risk in the wrong place. Separation of duties is a stronger, simpler design.
Learn more 25 Feb 2026
WAF for SaaS custom domains
Custom domains are a SaaS growth lever and an attack surface. Here is how to protect them without the WAF ever holding a private key.
Learn more 4 Feb 2026
API-first WAF architecture
When every WAF policy is an API object with immutable versions, security becomes reviewable, automatable, and safe to roll back.
Learn more Put a guide into practice
Start free on your first domain and follow along in detect mode.