What criterias do you look for in a WAF (web application firewall)?

Question

I am trying to assess a few WAFs

1) performance

2) coverage

3) accuracy

4) scalable

are few things I am looking at but what else do you look at if you are evaluating a WAF?

Answer 1

Support - Who is this vendor? What kind of support do they have? do you feel comfortable counting on their support?

Visibility - The way it transforms data into actual security-relevant information

Actionable insight - What can I do with that data? can you do it on your own or do you need to call the vendor for help/configuration changes?

Agility - What it takes to change settings? how quickly? how easily can I do it?