Fastly Next-Gen WAF review
A flexible WAF for teams protecting applications, APIs, and microservices across varied deployments.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Fastly Next-Gen WAF protects web applications, APIs, and microservices from malicious and anomalous traffic. It is aimed at application security and DevOps teams that need centralized visibility and protection across distributed environments. The product supports web, Linux, and API use cases, with a hybrid deployment model that can place protection at the edge, in the cloud, or within infrastructure through an agent and module.
Its strongest differentiator is the range of detection and response controls. Contextual request detection with SmartParse works alongside blocking and request-logging modes, attack and anomaly signals, API and CVE signals, configurable request and signal-exclusion rules, and advanced rate limiting. Virtual patches address CVEs, while bot detection and mitigation capabilities extend coverage beyond conventional request filtering. This combination suits teams that need more than a fixed ruleset and want to tune enforcement around application behavior.
Fastly also fits teams with infrastructure automation requirements through its Next-Gen WAF API and Terraform integration. The edge, cloud, and agent options provide flexibility, though they require a clear deployment approach across the environments being protected. Published pricing uses a contact-sales model, and there is no free plan, so it is better suited to organizations evaluating a managed commercial WAF than to teams seeking a self-serve entry point. Choose it for distributed application protection, virtual patching, bot controls, and programmable management; consider an alternative if transparent self-service pricing or a single deployment path is the priority.
Fastly Next-Gen WAF pros and cons
- Where it wins
- Contextual detection combines SmartParse with attack, anomaly, API, and CVE signals.
- Virtual patches and advanced rate limiting support responsive traffic control.
- Edge, cloud, and agent deployment options suit distributed application environments.
- Where it doesn't
- Contact-sales pricing requires a direct buying conversation before budgeting.
- Three deployment models create additional architecture and implementation choices.
- Data retention varies by entitlement and is capped at 30 days.
Fastly Next-Gen WAF fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update