Fastly Named a Leader in the 2026 IDC MarketScape for WAAP

Fastly has been named a Leader in the IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment. 

AI has changed how most companies do business. It makes routine work faster and lets teams scale with little more than a token budget. That shift includes attackers. Cybercrime is a business like any other, and attackers want the same efficiency gains as the companies they target. With the help of AI tooling, attackers can find and chain vulnerabilities faster and more cheaply than they could a year ago, and each new model makes threats harder to predict. 

Still, the basic principles of security haven't changed. The question for a CISO is the same as it's always been: does your protection actually stop attacks when your team isn't watching? Not every attack can be prevented, even with the best defenses. That's why defense needs to be layered and automated, so it holds when an attack gets through.

We've always designed our security products with these best practices in mind. We're pleased to report that Fastly was recently named a Leader in the IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment (doc # US54130626, September 2026).

IDC MarketScape weighs both what a platform does today and how well a vendor's strategy fits what customers will need over the next three to five years. Getting here meant building on Next-Gen WAF and then rapidly expanding to a full security platform – DDoS Protection, Bot Management, API Security, and Client-Side Protection – within just a few years. All of this security runs on our resilient network, and most importantly, it keeps our customers’ applications and workloads protected in production.

So how does that protection hold up when your team isn’t watching?

IDC MarketScape vendor analysis model is designed to provide an overview of the competitive fitness of technology and suppliers in a given market. The research methodology utilizes a rigorous scoring methodology based on both qualitative and quantitative criteria that results in a single graphical illustration of each supplier’s position within a given market. The Capabilities score measures supplier product, go-to-market and business execution in the short-term. The Strategy score measures alignment of supplier strategies with customer requirements in a 3-5-year timeframe. Supplier market share is represented by the size of the icons.  

SOURCE: IDC MarketScape, Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment (Doc #US54130626 September 2026).

Protection that's On, Not Just Deployed

A WAF that runs in monitoring mode only might address a compliance requirement, but it doesn't meaningfully reduce risk unless you dedicate time and resources to manually assess whatever it is monitoring. The IDC MarketScape noted, “Fastly's Next-Gen WAF parses and tokenizes each request to evaluate execution context rather than pattern matching with regular expressions or a standard rule set. The SmartParse engine has been a key asset for Fastly, as the company indicates it allows 90% of customers to deploy WAF in full blocking mode with very low reported false positives.”

That trust is possible because Fastly’s proprietary SmartParse detection engine evaluates whether a request would actually execute in production, rather than simply matching patterns. It blocks real attacks while keeping false positives low. That means less risk from day one and more time spent addressing real threats instead of tuning or chasing false positives.

Mitigation that Doesn't Wait for a Human

When more attacks are automated, the resulting defense needs to be automated as well. This past December, the Fastly Adaptive Threat Engine automatically detected a 220-billion-request DDoS attack, several times larger than anything else observed that year. The targeted customer was protected automatically, with no action required on their part, because the Adaptive Threat Engine continuously adjusts to changing traffic patterns. It runs inline in every POP across our 622 Tbps network, in a single pass along with WAF, bot management, and API inspection, without any added latency from a scrubbing-center detour. 

Raising the Attacker's Cost

Being blocked tells an attacker they've been caught and prompts them to adjust their approach to evade detection again. Deception, our patent-pending approach to credential stuffing, returns an invalid-credentials response instead, so the attacker thinks their attempt failed. It turns their efforts into noise and makes their campaign more expensive to run. Beyond deception, our Network Learning Exchange (NLX) acts as a preemptive filter, flagging an IP already validated as malicious elsewhere on our network the moment it arrives, before it reaches your application.

What’s Next?

AI will keep changing how attacks execute and applications are built. Our job as security professionals is to keep the fundamentals sharp – defense in depth and preparedness – and combine them with accurate detection, automatic mitigation, and a network that learns from every attack to achieve security that actually works in production. Then, apply it wherever AI shows up in your business:

• In September, Fastly launched AI Firewall, which evaluates prompts in the request path and blocks prompt injection and other LLM attacks before they reach your models.

• Newly released API Security capabilities enforce API contracts across conventional, agent-assisted, and agentic traffic, so you can stop agents from calling unsupported operations or acting outside the boundaries you've set.

• AI Runtime Control gives you a single endpoint for model calls across providers, with protected credentials, spend visibility, and budget limits.

• These new additions join AI Bot Management, which already gives customers control over AI crawlers and fetchers, whether content is stored in cache or accessed from origin servers.

We're excited about helping our customers solve their most pressing security problems, with a combination of innovation and time-tested success built on solid security foundations. Together, we can protect your business everywhere, across the models, applications, and agents your business now runs on.

Thank you to our customers who spoke with IDC MarketScape, and to the massive team at Fastly that builds this security platform every day.

Read the IDC MarketScape excerpt featuring Fastly.