Fastly’s 2026 WAAP Assessment Highlights Blocking, Automated Mitigation and AI Controls

Fastly’s selection as a Leader in the IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment puts attention on a practical security question: can a web application and API protection platform block harmful requests in production without requiring constant human tuning? The assessment considers both a supplier’s current capabilities and how its strategy aligns with customer needs over the next three to five years.

That question has gained weight as companies put AI tools into everyday workflows. The source of the pressure is two-sided: AI can help teams build and operate software faster, while attackers can use new tools to speed up vulnerability discovery and combine weaknesses with less effort. Defenses still need familiar foundations: accurate detection, multiple layers of protection and a plan for attacks that get through. Automation matters because security teams can’t review every request as it arrives.

Fastly says it has expanded from its Next-Gen WAF into a broader set of services, including DDoS Protection, Bot Management, API Security and Client-Side Protection. The company says these services run on its network. The assessment, identified as document US54130626 and dated September 2026, evaluates vendor capabilities and strategy; it does not by itself show how a platform will perform in every customer’s environment.

IDC describes its MarketScape as a comparative vendor assessment based on qualitative and quantitative criteria. Its capabilities score covers near-term products, market approach and business execution, while its strategy score looks at alignment with customer needs across a three-to-five-year period. The size of each supplier’s icon represents market share. Fastly’s Leader designation is therefore an assessment of both present capabilities and future direction, rather than a standalone measure of protection for a particular application.

Why blocking mode matters

Many web application firewalls can be configured to observe requests without stopping them. That mode can help teams understand what a system sees, but it leaves the decision to investigate and respond with people. The practical value of blocking depends on whether teams can enable it without disrupting legitimate traffic.

IDC’s assessment says Fastly’s Next-Gen WAF examines and tokenizes each request to assess its execution context, rather than relying on regular-expression matching or a standard set of rules. It also reports that 90% of Fastly customers deploy the WAF in full blocking mode, with very low reported false positives. Those figures are attributed to the assessment and company information; the source doesn’t provide a testing method or a breakdown by workload.

Fastly calls the underlying system SmartParse. The stated aim is to judge whether a request could execute in production, which can help distinguish an exploit attempt from traffic that merely resembles one. For teams, the potential benefit is less time spent reviewing false alarms and more confidence when blocking requests. The tradeoff to examine is how the detection behaves with each application’s traffic, integrations and unusual request patterns. A reported customer average can inform an evaluation, but it cannot replace a staged rollout and monitoring in the customer’s own environment.

Mitigation within the request path

Fastly also points to automated response as a way to reduce the time between an attack beginning and defenses adapting. The company says its Adaptive Threat Engine detected a DDoS attack involving 220 billion requests in December 2025 and protected the targeted customer automatically, without an action from that customer. The source describes the event as several times larger than other attacks observed that year.

According to Fastly, the engine adjusts to changing traffic patterns and runs inline at each point of presence across its network, which the company lists at 622 Tbps. It processes traffic alongside WAF, bot and API inspection, without routing it through a separate scrubbing center. That design could reduce operational handoffs during an attack, while keeping inspection on the same path as application traffic. The source does not provide a latency measurement, so the impact for a particular service will depend on its own traffic and setup.

Making repeated attacks less useful

Fastly’s approach also includes techniques intended to make attacker behavior harder to refine. Its credential-stuffing deception feature returns an invalid-credentials response rather than indicating that an attempt was detected. The intent is to make automated attempts appear unsuccessful, leaving an attacker with less information to adjust the next request. Fastly describes the method as patent-pending.

Its Network Learning Exchange takes a different route: Fastly says it can flag an IP address already identified as malicious elsewhere on its network as soon as it arrives. In principle, shared signals let defenses act before a request reaches an application. The value depends on the quality and freshness of those signals, and on how teams handle traffic that might be misclassified.

Security controls for AI traffic

Fastly’s next set of products extends its security focus to applications that use models and automated agents. The company says it launched AI Firewall in September. It evaluates prompts in the request path and is designed to block prompt injection and other attacks against large language models before requests reach the models.

New API Security capabilities are described as enforcing API contracts across conventional, agent-assisted and agentic traffic. In practical terms, API contracts define supported operations and expected request shapes. Applying those constraints to agent traffic could help teams limit calls to permitted operations, though the source does not detail how customers define or update those boundaries.

AI Runtime Control provides a single endpoint for model calls across providers, with protected credentials, spend visibility and budget limits, according to Fastly. AI Bot Management gives customers controls for AI crawlers and fetchers, including whether content is served from cache or accessed from origin servers. Together, these products point to a broader operational concern: AI use adds request types, credentials and automated clients that teams may need to manage alongside conventional application traffic.

The assessment gives buyers a reason to examine Fastly’s combined platform, especially if they want blocking, traffic mitigation and API inspection on a shared network. The decision still turns on deployment details: how accurately controls handle real traffic, how they fit existing systems, and what visibility teams get when a rule blocks a request. As companies add model calls and agents to production, those questions will shape whether a unified security platform reduces day-to-day work or simply adds another layer to configure.

Read the IDC MarketScape excerpt featuring Fastly.