I mean, it's hardly surprising CloudFlare will tell you this is a useful product. But it is to securing a web application what regex is to parsing HTML.

Sadly I work with web developers that all assume they don’t need to bother too much with security “because we have a WAF”.