eBook

Are Your Applications Ready for Minus-Zero-Day Attacks? Securing Modern Applications and APIs in Frontier AI Era

For security, application, and risk leaders evaluating web app and API protection in the AI era.

Are Your Applications Ready for Minus-Zero-Day Attacks? | 02

Table of Contents

Executive Summary 03

01 Minus Zero Day: Exploited Before the World Knows It Exists 05

02 The AI Era Has Expanded the Attack Surface 12

03 Why Signature and Rule-Based WAFs Cannot Keep Up 15

04 How Check Point WAF Meets the Criteria 18

05 Proof Point: Check Point WAF Zero Day Readiness Module 22

06 Your AI-Era Readiness Checklist 25

Conclusion & Sources 27

Executive Summary Application Security Is Now a Business-Critical Decision

Applications are how organizations compete, transact, and

deliver digital experiences. In the AI era, they are complex ecosystems of APIs, microservices, third-party integrations, and GenAI capabilities and attackers have

adapted. New frontier AI models are accelerating vulnerability discovery to the point where exploitation now

happens before disclosure. What the market has always called a

"zero day" is becoming a "minus-zero-day" - an exploit

already running in the wild while defenders have no idea it

exists. In 2025, organizations faced an average of 1,968

cyberattacks per week, a 70% increase over two years

(Check Point Cyber Security Report 2026). The number of

published vulnerabilities continues to rise sharply while the

response window continues to shrink. The traditional model of

waiting for a signature, tuning a rule, and applying a patch can no longer keep pace.

70% Increase in Weekly Cyberattacks

Organizations faced an average of 1,968 cyberattacks

per week in 2025, a 70% increase over two years.

Are Your Applications Ready for Minus-Zero-Day Attacks? | 03

https://www.checkpoint.com/press-releases/check-point-softwares-2026-cyber-security-report-shows-global-attacks-reach-record-levels-as-ai-accelerates-the-threat-landscape/

The business consequences are direct. A single successful

application attack can take a revenue-generating service

offline, expose customer data that triggers regulatory fines,

and erode the trust that digital businesses depend on.

Emergency patching compounds the damage, while false

positives that block legitimate customers create lost

sales and support burden on top of that. The IBM 2025 Cost

of a Data Breach Report puts the average global data

breach cost at $4.44 million. For most WAFs, this reactive

cycle is fundamental to how they work leaving organizations exposed during every emergency update and

blocking the customers they are trying to serve in the process.

$4.44M Average Global Data Breach Cost

Source: IBM 2025 Cost of Data Breach Report

This eBook is written to give leaders the knowledge and tools to successfully navigate this dynamic security landscape It explains what has

changed in the application threat landscape, what AI-era-ready application and API security must deliver, and how to evaluate solutions so

that organizations can protect the business without slowing it down.

Are Your Applications Ready for Minus-Zero-Day Attacks? | 04

01 Minus Zero Day: Exploited Before the World Knows It Exists

Are Your Applications Ready for Minus-Zero-Day Attacks? | 05

1. Minus Zero Day: Exploited Before the World Knows It Exists Application Security Is Now a Business-Critical Decision

A growing share of attacks now arrives as minus-zero-day

exploits, that means vulnerabilities already being used in the

wild before they are publicly disclosed or assigned a CVE. The

affected organization has no advisory to read, no patch to apply,

and often no sign that anything is wrong. This is not a WAF

specific problem, it is a structural shift in how vulnerabilities are discovered and weaponized.

The evidence is unambiguous. In 2023, 70% of exploited

vulnerabilities were attacked as zero days, before any patch

existed, up from 62% a year earlier (Mandiant, 2023). By 2026,

the mean time from disclosure to exploitation had turned

negative, to roughly minus seven days (Mandiant M-Trends

2026). Exploitation increasingly comes first, and disclosure catches up later.

Are Your Applications Ready for Minus-Zero-Day Attacks? | 06

The minus-zero-day window: exploited before it is public

Are Your Applications Ready for Minus-Zero-Day Attacks? | 07

Minus-zero-day window

Exploitation in the wild

before disclosure

Signature / rule-based WAFs start here

need a signature first — the whole window above is missed

Check Point WAF blocks the first attempt — no signature needed

time

disclosure +20 d (median patch)

Figure 1 — The minus-zero-day window: exploitation now precedes public disclosure. Signature-based WAFs cannot act until a signature

Minus Zero Day: Exploited Before the World Knows Exits

Check Point’s research team sees this shift in its own data. As

AI enables attackers to discover vulnerabilities, generate

exploits, and launch attacks at unprecedented speed and scale,

the window between vulnerability discovery and active

exploitation continues to be negative. Looking at CISA’s Known

Exploited Vulnerabilities (KEV) catalog the industry’s

benchmark for vulnerabilities confirmed to be exploited in the

wild a rising share of those vulnerabilities had already appeared

in Check Point telemetry before CISA added them to the list.

Among the exploited vulnerabilities Check Point observed, the

share seen before their official listing climbed from 34% in 2023

to a majority by 2025, reaching 56% in 2026. In practice,

customers were already protected against active exploitation

before the industry formally recognized it.

Are Your Applications Ready for Minus-Zero-Day Attacks? | 08

Seen before it was official (of KEV CVEs we observed)

2023 34%

2024 46%

2025 52%

2026 56%

Figure 2 — Share of exploited vulnerabilities Check Point observed before their official CISA KEV listing, 2023–2026.

Patching critical systems takes planning, testing, and change control. Attackers do not wait. The median time from

vulnerability disclosure to first observed exploit has collapsed from 771 days in 2018 to about six days in 2023 and

roughly four hours in 2024; by 2025 most exploited vulnerabilities were weaponized before they were even disclosed (Zero Day Clock).

The fix itself now accelerates the attack. AI can

reverse-engineer a security patch and produce a working

exploit in minutes. Attacks may begin spreading within

hours, while organizations take an average of around 20

days to test and deploy the same patch. This leaves organizations exposed for most of the patching window and

makes monthly patch cycles alone insufficient (Zero Day

Clock). The period between a vulnerability becoming known and

being safely remediate-the exposure gap-is where businesses now face the greatest risk.

the median time from disclosure to first

exploit -771 days in 2018, and before disclosure by 2025, while the median patch still takes about 20 days.

Source: Zero Day Clock

Are Your Applications Ready for Minus-Zero-Day Attacks? | 09

https://zerodayclock.com/collapse https://zerodayclock.com/collapse

Patching critical systems takes planning, testing, and change control. Attackers do not wait. The median time from vulnerability disclosure

to first observed exploit has collapsed from 771 days in 2018 to about six days in 2023 and roughly four hours in 2024; by 2025 most

exploited vulnerabilities were weaponized before they were even disclosed (Zero Day Clock).

The fix itself now accelerates the attack. AI can reverse-engineer a security patch and produce a working exploit in minutes. Attacks

may begin spreading within hours, while organizations take an average of around 20 days to test and deploy the same patch. This

leaves organizations exposed for most of the patching window and makes monthly patch cycles alone insufficient (Zero Day Clock). The

period between a vulnerability becoming known and being safely remediate-the exposure gap-is where businesses now face the greatest risk.

Are Your Applications Ready for Minus-Zero-Day Attacks? | 10

The Trend Time to exploit is collapsing toward zero. Vulnerability volume is going vertical.

https://zerodayclock.com/collapse https://zerodayclock.com/collapse

Are Your Applications Ready for Minus-Zero-Day Attacks? | 11

Time-to-exploit has collapsed

The trend from 2018 to 2025 is clear, vulnerability volumes are rising while the time to exploitation is shrinking. Signature-based WAFs

and monthly patching cycles can no longer keep pace with attacks moving at machine speed.

Figure 2 — Median time from disclosure to first exploit, 2018–2025 (Zero Day Clock).

1000 d

100 d

10 d

1 d

771 d

2018

84 d

2021

6 d

2023

4 h

2024 2025

before

disclosure

Source: Zero Day Clock (median TTE across 83,000+ CVEs).

Median

time

from disclosure to

exploit

(log)

02 The AI Era Has Expanded the Attack Surface

Are Your Applications Ready for Minus-Zero-Day Attacks? | 12

The AI Era Has Expanded the Attack Surface Every new app, API, and AI feature is a new door to defend

The way applications are built has decentralized. Cloud

platforms, microservices, containers have driven an explosion

of APIs, and APIs now carry most of the application traffic. AI

is accelerating this shift, as every new AI capability introduces additional models, prompts, data flows, and API

interactions that must be discovered, governed, and protected.

This is already the norm, 70% of organizations run GenAI

workloads in production and 64% have deployed AI agents in

live environments (Check Point 2026 Cloud Security Report). Yet

visibility has not kept up: only 5% of organizations have

full visibility into how AI is used, and just 14% actively enforce and audit an AI security policy (Check Point 2026

Cloud Security Report).

70% of organizations run GenAI workloads in production — but only 5% have full visibility into how AI is used.

Are Your Applications Ready for Minus-Zero-Day Attacks? | 13

https://engage.checkpoint.com/2026-cloud-security-report-securing-the-ai-transformation?_gl=1*1jby57p*_gcl_aw*R0NMLjE3ODIyNTA3NTkuQ2p3S0NBanczZWpSQmhBZEVpd0FEa3FQbjZsVmllTkJNM3YzQXBXRHkyNWFEaDBkeDNzNEZDbGhfUkFOU3NPcXZJemlCQXh2cXZlS014b0NfZm9RQXZEX0J3RQ..*_gcl_au*MjkzNDk3NTUzLjE3Nzc1NDgyMDUuMTM0Mzg0ODE4NC4xNzgzNjAwMTcxLjE3ODM2MDAxNzg. https://engage.checkpoint.com/2026-cloud-security-report-securing-the-ai-transformation?_gl=1*1jby57p*_gcl_aw*R0NMLjE3ODIyNTA3NTkuQ2p3S0NBanczZWpSQmhBZEVpd0FEa3FQbjZsVmllTkJNM3YzQXBXRHkyNWFEaDBkeDNzNEZDbGhfUkFOU3NPcXZJemlCQXh2cXZlS014b0NfZm9RQXZEX0J3RQ..*_gcl_au*MjkzNDk3NTUzLjE3Nzc1NDgyMDUuMTM0Mzg0ODE4NC4xNzgzNjAwMTcxLjE3ODM2MDAxNzg. https://engage.checkpoint.com/2026-cloud-security-report-securing-the-ai-transformation?_gl=1*1jby57p*_gcl_aw*R0NMLjE3ODIyNTA3NTkuQ2p3S0NBanczZWpSQmhBZEVpd0FEa3FQbjZsVmllTkJNM3YzQXBXRHkyNWFEaDBkeDNzNEZDbGhfUkFOU3NPcXZJemlCQXh2cXZlS014b0NfZm9RQXZEX0J3RQ..*_gcl_au*MjkzNDk3NTUzLjE3Nzc1NDgyMDUuMTM0Mzg0ODE4NC4xNzgzNjAwMTcxLjE3ODM2MDAxNzg.

The attackers exploiting this surface have industrialized

too. Capabilities once limited to well-funded groups are now widely available: attackers use AI to scan for weaknesses,

create and modify malicious payloads, and launch campaigns at

greater speed and scale. Defenders face not only more attacks,

but new techniques emerging faster.

At the same time, the number of known vulnerabilities has

grown sharply with AI. The world published about 18,000

vulnerabilities in 2018 and nearly 50,000 in 2025, with

the steepest single-year jumps landing exactly on the

agentic-coding and reasoning-model wave; high-severity vulnerabilities alone more than doubled (ProjectDiscovery,

2026). As more code is created faster by both people and

machines, more exploitable flaws can reach production.Organizations that depend on a new signature for

every attack variant cannot keep pace with threats operating at machine speed.

The business cost is not only from attacks that get

through but also from false positives, when legitimate

customer requests blocked by an over-aggressive WAF

rule are a direct revenue and trust problem. A checkout

page that blocks valid payment because a WAF rule

fires on an unusual but legitimate request loses the

sale. A login flow that locks out a genuine user because

a rule was tuned too broadly creates a support burden

and damages confidence in the application. According

to the 2026 WAF Comparison Project, the industry

median false-positive rate is over 8%. At that

rate, roughly one in eight legitimate users may be

blocked during an active rule deployment of a hidden

cost that rarely appears in security budgets but shows up directly in conversion rates and customer satisfaction scores.

Are Your Applications Ready for Minus-Zero-Day Attacks? | 14

https://projectdiscovery.io/blog/the-vulnerability-curve-bent-with-the-ai-curve

03 Why Signature and Rule-Based WAFs Cannot Keep Up

Are Your Applications Ready for Minus-Zero-Day Attacks? | 15

Are Your Applications Ready for Minus-Zero-Day Attacks? | 16

Why Signature and Rule-Based WAFs Cannot Keep Up Every new app, API, and AI feature is a new door to defend

Most web application firewalls (WAF) follow the same

cycle, a vulnerability is disclosed, a signature

is created, a rule is applied, exceptions are tuned,

and a patch is deployed. This approach may work for

slower-moving threats, but it breaks down when

attackers mutate payloads and exploit vulnerabilities before signatures or patches are available.

This is exactly why signature-based WAFs are blind to minus-zero-day attacks. When vulnerability is exploited

before it is disclosed, there is no CVE, no signature, and no

rule to write, so a WAF that matches known patterns has nothing

to match and lets the request pass as normal traffic. Every WAF

that depends on prior knowledge of an attack shares this gap,

which is why in-the-wild exploitation now regularly succeeds

on the first attempt.

It also creates a costly trade-off. Rules that are too narrow

miss attack variants, while rules that are too broad block

legitimate users. When accuracy is low, security teams lose

confidence and hesitate to prevent applications, leaving

applications in detect-only mode while attacks succeed on the first request.

In the AI era, a WAF that cannot operate safely in prevention mode becomes little more than another source of alerts. The business

implication is significant; every hour a team spends tuning rules is an hour not spent on other security work. And every false positive that

blocks a paying customer is lost revenue that the security tool directly caused.

Closing the minus-zero-day gap requires protection that judges each request by its behavior and context rather than waiting for a known signature.

Are Your Applications Ready for Minus-Zero-Day Attacks? | 17

04 How Check Point WAF Meets the Criteria

Are Your Applications Ready for Minus-Zero-Day Attacks? | 18

Are Your Applications Ready for Minus-Zero-Day Attacks? | 19

How Check Point WAF Meets the Criteria AI-driven, contextual prevention for apps, APIs, and GenAI

Check Point WAF is fully automated, AI-powered

solution that does not depend on signatures or

manually written rules for protection. It uses contextual AI to analyze every request, understand normal application behaviour, and block

malicious activity in real time. Supervised AI

identifies known attack techniques and their variants, while unsupervised AI detects abnormal

behaviour that may signal a new or previously

unknown threat. Together, they protect against known

and zero-day attacks while maintaining low false-positive rates, helping customers operate confidently in prevention mode.

This approach helps close the exposure gap between the first

exploitation attempt and the eventual deployment of a patch or

signature. Because Check Point WAF protects applications at

runtime and does not wait for an attack-specific update, it

can block exploitation attempts while organizations test and

deploy the necessary patches. Check Point WAF has demonstrated

this prevention-first approach against major zero-day vulnerabilities, including Log4Shell, Spring4Shell,

and MOVEit, without requiring emergency signature

updates. It also protected customers against React2Shell

before widespread exploitation in the wild.

Are Your Applications Ready for Minus-Zero-Day Attacks? | 20

DDoS

Protection

Client-side

Protection

Bot

Mitigation

API

Security

GenAI-Enabled

App Security

Web App

Security

Check Point WAF

AI-Powered Application

CDN

High Detection

Low False Positives

No Manual Tuning

Protection extends across the modern application attack

surface, including end-to-end API security, bot mitigation,

built-in DDoS protection and CDN capabilities, and GenAI

safeguards against prompt injection, sensitive-data

leakage, harmful content, and abuse. These capabilities are

delivered through a single, unified platform rather than disconnected

point solutions. The platform is also designed to reduce

operational burden. Its contextual, self-learning approach

minimizes manual rule creation, signature maintenance,

exception tuning, and false-positive cleanup, making it practical for organizations to run continuously in prevention mode.

Independent analyst recognition further validates Check Point WAF position - GigaOm named Check Point a Leader and Fast Mover in its 2026

Radar for Application and API Security. In 2026 WAF comparison testing, Check Point achieved a 99.3% detection rate with a 0.81%

false-positive rate. Frost & Sullivan also recognized Check Point as a technology innovation leader, highlighting its prevention-first architecture, near-perfect detection, and low false positives.

Are Your Applications Ready for Minus-Zero-Day Attacks? | 21

Signature-Based WAF Check Point WAF AI-Powered

REACTIVE

PROACTIVE

REACTIVE

CVE disclosure

Wait for signature

Tune rules

Handle false positives

Patch when possible

Inspect every request

Understand context

Prevent in real time

+ BUILT-IN

+ Learn and adapt

+ Protect legitimate traffic

Continuous, always-on

https://engage.checkpoint.com/2026-gigaom-radar-report-for-application-api-security-waap?_gl=1*1imv73i*_gcl_aw*R0NMLjE3ODIyNTA3NTkuQ2p3S0NBanczZWpSQmhBZEVpd0FEa3FQbjZsVmllTkJNM3YzQXBXRHkyNWFEaDBkeDNzNEZDbGhfUkFOU3NPcXZJemlCQXh2cXZlS014b0NfZm9RQXZEX0J3RQ..*_gcl_au*MjkzNDk3NTUzLjE3Nzc1NDgyMDUuMTM0Mzg0ODE4NC4xNzgzNjAwMTcxLjE3ODM2MDAxNzg. https://www.checkpoint.com/resources/items/report-waf-comparison-project-2026 https://engage.checkpoint.com/2026-frost-sullivan-report-for-web-application-api-security-waf?_gl=1*s1nd6n*_gcl_aw*R0NMLjE3ODIyNTA3NTkuQ2p3S0NBanczZWpSQmhBZEVpd0FEa3FQbjZsVmllTkJNM3YzQXBXRHkyNWFEaDBkeDNzNEZDbGhfUkFOU3NPcXZJemlCQXh2cXZlS014b0NfZm9RQXZEX0J3RQ..*_gcl_au*MjkzNDk3NTUzLjE3Nzc1NDgyMDUuMTM0Mzg0ODE4NC4xNzgzNjAwMTcxLjE3ODM2MDAxNzg.

05 Proof Point: Check Point WAF Zero Day Readiness Module

Are Your Applications Ready for Minus-Zero-Day Attacks? | 22

Proof Point: Check Point WAF Zero Day Readiness Module Zero day Protected before signatures and emergency updates catch up

Check Point WAF has demonstrated pre-emptive protection

against major zero-day application attacks, helping customers reduce emergency response burden and exposure windows.

The following table shows Market examples of top 10 WAAP

zero-day attacks happened in last 18months (Jan 2025- July

2026). To further validate its ability to protect against emerging threats, Check Point WAF tested against these zero-day attacks-

R&D tested Check Point WAF against the highest-profile zero

day and WAAP-relevant attacks of the period in an isolated lab.

The table summarizes, per attack, whether the exploit was

blocked and the key finding.

Are Your Applications Ready for Minus-Zero-Day Attacks? | 23

Are Your Applications Ready for Minus-Zero-Day Attacks? | 24

Sno CVE CVSS Attack Check Point WAF-blocked?

1 CVE-2025-64459 9.1 Django ORM SQL Injection Yes

2 CVE-2025-24813 9.8 Apache Tomcat partial PUT Yes

3 CVE-2025-66516 9.8 Apache Tika XXE / SSRF Yes

4 CVE-2025-61882 9.8 Oracle EBS pre-auth RCE Yes

5 CVE-2025-4123 6.1 Grafana “Ghost” takeover Yes

6 CVE-2025-31324 9.8 SAP NetWeaver VC uploader Yes

7 CVE-2025-53770 9.8 SharePoint “ToolShell” RCE No

8 CVE-2025-54253 10 Adobe AEM Forms OGNL RCE Yes

9 CVE-2025-55182 10 React Server Components “React2Shell”

Yes

https://nvd.nist.gov/vuln/detail/CVE-2025-64459 https://nvd.nist.gov/vuln/detail/CVE-2025-24813 https://nvd.nist.gov/vuln/detail/CVE-2025-66516 https://nvd.nist.gov/vuln/detail/CVE-2025-61882 https://nvd.nist.gov/vuln/detail/CVE-2025-4123 https://nvd.nist.gov/vuln/detail/CVE-2025-31324 https://nvd.nist.gov/vuln/detail/CVE-2025-53770 https://nvd.nist.gov/vuln/detail/CVE-2025-54253 https://nvd.nist.gov/vuln/detail/CVE-2025-55182

06 Your AI-Era Readiness Checklist

Are Your Applications Ready for Minus-Zero-Day Attacks? | 25

Are Your Applications Ready for Minus-Zero-Day Attacks? | 26

Your AI-Era Readiness Checklist Ten questions to ask about your WAF before your next application security review. If the answer to any of these is "no" or "not sure,"

your current WAF may be leaving the business exposed.

Can my WAF block zero-day attacks before a signature exists?

Can my WAF protect applications without taking them

offline/need emergency patching to deploy updates?

Can my WAF run in prevention mode without blocking

legitimate users?

Can my WAF discover and protect APIs as they change,

including shadow and zombie endpoints?

Can my WAF validate API schemas and inspect API

payloads?

Can my WAF enforce authenticated API access?

Can my WAF protect GenAI prompts, responses, and usage

patterns?

Can my WAF show benchmark evidence for both blocking

and false positives?

Does my WAF enforce one consistent policy across cloud,

container, and edge?

Does my WAF integrate into CI/CD and reduce operational burden?

Conclusion Secure Innovation Without Disrupting Users

New vulnerabilities will keep surfacing, and attackers will keep

using AI to exploit them faster and at lower cost.

The organizations that stay ahead will move from detecting

attacks to prevent them, and will protect the whole application

surface from web, API, and new GenAI threats without

blocking the customers they are trying to serve.

In the AI era, application security is no longer only

about reducing risk. It is about revenue continuity (applications stay online), customer trust (legitimate users

are never blocked), and team capacity (engineers spend time

building, not tuning). Check Point WAF is designed to

deliver all three, AI-driven prevention that stops known

and unknown attacks, stays accurate enough to run in

prevention mode, and removes the operational burden that

signature-based WAFs impose. The best security is the kind that nobody notices because it works.

See how Check Point WAF delivers complete application security for the AI era. Book a Demo

https://pages.checkpoint.com/cloudguard-cloud-security-demo.html

Check Point, Cyber Security Report 2026

press release · research overview.

Check Point, 2026 Cloud Security Report: Securing the AI

Transformation — overview.

Check Point, Under Pressure: The 2026 Exposure Gap Report:

press release · overview.

ProjectDiscovery, “The Vulnerability Curve Bent With the AI

Curve” (2026): article.

Zero Day Clock — live Time-to-Exploit tracker across 83,000+

CVEs from ten feeds including CISA KEV, ExploitDB, and

Metasploit — The Collapse.

Mandiant (Google Cloud), “How Low Can You Go? An Analysis of

2023 Time-to-Exploit Trends” (2024)- Time-to-Exploit Trends

Mandiant, M-Trends 2026 — estimated mean time to exploit has

turned negative (approximately minus seven days).

Verizon, 2026 Data Breach Investigations Report (DBIR) — 2026

DBIR: Public Sector Threat Analysis | Verizon

Check Point WAF Leader in GigaOm in its 2026 Radar for

Application and API Security

WAF Comparison Project- 2026 WAF comparison testing

Check Point WAF Leader in Frost & Sullivan technology Innovation Leader

Sources

www.checkpoint.com © 2026 Check Point Software Technologies Ltd. All rights reserved.

https://www.checkpoint.com/press-releases/check-point-softwares-2026-cyber-security-report-shows-global-attacks-reach-record-levels-as-ai-accelerates-the-threat-landscape/ https://research.checkpoint.com/2026/cyber-security-report-2026/ https://blog.checkpoint.com/securing-the-cloud/2026-cloud-security-report-why-traditional-network-cloud-and-security-architecture-are-lagging-behind-the-ai-transformation/ https://www.prnewswire.com/news-releases/as-ai-floods-security-teams-with-alerts-new-check-point-exposure-management-research-finds-critical-vulnerabilities-have-doubled-yet-fewer-than-1-in-12-demand-urgent-action-302816720.html https://blog.checkpoint.com/exposure-management/under-pressure-insights-from-the-2026-exposure-gap-report https://projectdiscovery.io/blog/the-vulnerability-curve-bent-with-the-ai-curve https://zerodayclock.com/collapse https://cloud.google.com/blog/topics/threat-intelligence/time-to-exploit-trends-2023 https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026 https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026 https://www.verizon.com/business/resources/reports/2026-dbir-public-sector-snapshot.pdf https://www.verizon.com/business/resources/reports/2026-dbir-public-sector-snapshot.pdf https://engage.checkpoint.com/2026-gigaom-radar-report-for-application-api-security-waap?_gl=1*1imv73i*_gcl_aw*R0NMLjE3ODIyNTA3NTkuQ2p3S0NBanczZWpSQmhBZEVpd0FEa3FQbjZsVmllTkJNM3YzQXBXRHkyNWFEaDBkeDNzNEZDbGhfUkFOU3NPcXZJemlCQXh2cXZlS014b0NfZm9RQXZEX0J3RQ..*_gcl_au*MjkzNDk3NTUzLjE3Nzc1NDgyMDUuMTM0Mzg0ODE4NC4xNzgzNjAwMTcxLjE3ODM2MDAxNzg. https://www.checkpoint.com/resources/items/report-waf-comparison-project-2026 https://engage.checkpoint.com/2026-frost-sullivan-report-for-web-application-api-security-waf?_gl=1*s1nd6n*_gcl_aw*R0NMLjE3ODIyNTA3NTkuQ2p3S0NBanczZWpSQmhBZEVpd0FEa3FQbjZsVmllTkJNM3YzQXBXRHkyNWFEaDBkeDNzNEZDbGhfUkFOU3NPcXZJemlCQXh2cXZlS014b0NfZm9RQXZEX0J3RQ..*_gcl_au*MjkzNDk3NTUzLjE3Nzc1NDgyMDUuMTM0Mzg0ODE4NC4xNzgzNjAwMTcxLjE3ODM2MDAxNzg. https://www.checkpoint.com