1 to 5 backend servers. If your environment is bigger than that, or you expect to grow past it soon, the WAF 460 and up step up in both server count and throughput.

It watches how your applications normally get used and builds a behavioral baseline from that traffic, then tightens security policy around it automatically. That means the WAF adapts as your application changes instead of relying only on rules you set once and forget.

Yes. Alongside OWASP Top 10 protection, it filters volumetric DDoS traffic, malicious bots, and abusive API calls before they reach your application servers, not just after they've already caused a problem.

Yes, it offloads SSL/TLS processing, handling up to 2,500 HTTPS transactions per second, so your application servers aren't spending CPU cycles on encryption work on top of serving requests.

The WAF 460, 660, 860, 960, and 1060 step up in throughput and backend server capacity, all the way to 10 Gbps at the top of the line, while keeping the same Adaptive Profiling and attack protection you'd already be used to.