Web application and API protection

Protection that learns
how your applications behave.

Cygent NG-WAF reads each request for its intent, not only for known signatures. It learns every application and API, stops automated abuse, and drafts a virtual patch when a new vulnerability affects you.

Request access Take the tour

Every application starts in monitoring mode. You decide when it moves to blocking.

Early access by request

NG-WAF · shop.example.com

Illustrative data

Requests / min

Blocked

Automated traffic

APIs learned

BLOCKPOST /api/login · credential stuffing, 37 addresses

BLOCKGET /search · obfuscated SQL injection

ALLOWGET /api/v2/orders · matches the learned schema

PATCHPOST /upload · virtual patch drafted for CVE-2026-1182

Application-layer inspection

REST · GraphQL · gRPC

API protocols learned

Ways to deploy

EN · AR

Investigation in your language

The problem

Why traditional WAFs fall behind

Signature rules miss obfuscated and novel payloads, and attackers test against them.

Tuning takes months, so many deployments stay in monitor-only mode forever.

APIs, bots and account takeover need context a rule cannot see.

When a critical CVE drops, teams wait for vendor rules while exposed.

Product tour

What your team sees every day

Four views from the NG-WAF console, with illustrative data.

Every decision, explained

Each blocked or challenged request carries the reason, the evidence and the rule that acted, so analysts can confirm a block in seconds instead of reading raw logs.

BLOCKPOST /api/logincredential stuffing · rule cs-41 · 37 IPs

BLOCKGET /search?q=%27%20UNIONSQLi intent (0.97) · obfuscated

CHALLENGEGET /pricingscraper behaviour · AS64500

ALLOWGET /api/v2/ordersschema match · known client

PATCHPOST /uploadvirtual patch vp-2026-1182 · monitor

Capabilities

Everything in one product

AI-native detection

Models read the intent of each request, not just signatures, to stop injection, deserialisation, SSRF and novel payloads, including zero-days.

Self-tuning

It learns each application’s normal behaviour and cuts false positives automatically. No months of tuning before go-live.

Behavioural bot defence

Separates people, good bots and malicious automation using behaviour, not CAPTCHAs, credential stuffing, scraping and fake sign-ups stop.

AI virtual patching

When a new CVE affects your stack, a precise protection rule is generated, tested against your traffic and proposed within minutes.

API protection

Automatic API discovery, schema learning and enforcement for REST, GraphQL and gRPC; shadow and abandoned APIs are surfaced.

Account takeover prevention

Risk scoring of every login from device, behaviour and reputation signals.

Adaptive rate limiting & L7 DDoS

Limits that follow real usage per endpoint and per client, absorbing application-layer floods.

Threat intelligence

Reputation and campaign data from Cygent Threat Intelligence, and attack-surface context from Cygent CAASM.

AI investigation

Ask in plain language: “why was this blocked?”, “who is attacking checkout?”, answers come with the evidence.

OWASP Top 10 and beyond

Full coverage of the OWASP Top 10 and API Top 10, with explainable decisions.

Data residency & privacy

Choose where logs and models live; sensitive fields are masked before storage.

Compliance evidence

Reports mapped to PCI DSS 6.4, ISO 27001 and SOC 2 controls, ready for auditors.

One policy everywhere

The same policy and console for every application, wherever it runs.

How it works

From first day to full protection

01
Observe
Starts in monitoring mode and learns your applications.
02
Recommend
AI proposes policies with the traffic that justifies them.
03
Protect
Switch to blocking per application when you are confident.
04
Improve
Every decision and analyst feedback makes the models sharper.

Investigation

Ask what happened. Get the evidence.

The investigation assistant answers in plain English or Arabic and links every statement to the requests behind it.

Answers cite request IDs, rules and time ranges
Suggested actions wait for your approval
Your traffic is never used to train shared models

Why did we block 412 checkout requests last night?

waf.investigate(app='shop', path='/checkout', window='12h')

A credential-stuffing run from 37 addresses in two hosting networks. Each request tried a password from a known leak; none succeeded.

Keep the block policy on /login and /checkout
Challenge both networks for the next 7 days
Reset passwords for the 12 accounts found in the leak

Compared

NG-WAF compared with a traditional WAF

Traditional WAF

Cygent NG-WAF

Detection

Signatures and regular expressions

Intent models plus signatures

Tuning

Manual, months per application

Learns each application automatically

New CVEs

Wait for vendor rules

Virtual patch proposed in minutes

Bots

CAPTCHAs and IP lists

Behavioural classification

APIs

Treated like web pages

Discovered, learned and enforced

Investigation

Raw logs

Questions in plain language, answers with evidence

Deployment

Deploy the way you run

Start in monitoring mode in hours, not weeks. Move to blocking per application when the evidence says you are ready.

Cloud edge

Point DNS to Cygent; TLS, caching and protection at the edge.

Reverse proxy

A lightweight gateway in your data centre or private cloud.

Kubernetes ingress

Native ingress controller and sidecar options.

Fully on-premises

Models and logs never leave your network.

Works with your tools

SplunkMicrosoft SentinelElasticQRadarSyslog / CEFSlackMicrosoft TeamsJiraServiceNowTerraformKubernetesCygent CAASM

Where teams use it

Online banking and payments

Stop credential stuffing and fraud bots on login and checkout without adding friction for real customers.

Public-sector portals

Protect citizen services against defacement, injection and floods, with logs kept in-country.

API-first products

Discover every endpoint, enforce the schema and catch broken object-level authorisation.

E-commerce at peak

Keep scrapers, scalpers and inventory bots out during launches and sales.

Legacy applications

Virtual patches shield systems that cannot be fixed quickly or at all.

Multi-cloud estates

One policy across cloud providers, Kubernetes and data centres.