SecureIQLab Cloud Web Application Firewall (WAF) CyberRisk Validation – Summer 2022

I have no specific comment on the conduct of this evaluation, which was particularly well done. I do, however, have a comment on the way the false positives metric is reported. Indeed, the false positive score is reported only with Operational Efficiency (OE) for the ROSI calculation. This makes sense because false positives have a significant impact on operational effectiveness, but it could be also interesting to have it reported with the Global Security (GS) score. Without, the GS score is basically a metric measuring only whether the solutions correctly detect attacks (recall metric or a catching rate) and not an accuracy metric  taking into account all dimensions of the evaluation (FP, FN, TP, TN), like a Matthews Correlation Coefficient (MCC) for instance. Of course, combining both OE and GS metrics we do have a good information, but having a WAF accuracy information via a single metric, such as a MCC score, plus the OE, would be very interesting.