GladiosWAF uses machine learning instead of static rules. Unlike traditional WAFs that rely on thousands of manually maintained signatures, GladiosWAF’s proprietary behavioral AI machine learning model automatically detects malicious requests by learning from real traffic patterns — no manual configuration needed.

No configuration is required. GladiosWAF is a zero-rule firewall — it predicts requests as malicious or non-malicious instantly, without any rule-tuning or maintenance fatigue.

An Intent Analysis in GladiosWAF happens in real time whenever an HTTP request is received. Instead of matching the request against static rules, GladiosWAF evaluates the intention using a machine learning model trained on real attack patterns.

First, relevant parts of the request — such as the URL path, query parameters, headers, and body — are then passed to the AI model, which analyzes these structure, intent, and behavior of the request rather than relying on keyword matching. The model analyse the payloads and outputs the intent of the request as either (Malicious or Non-Malicious).

Based on this result, GladiosWAF can either allow or block the request — depending on your deployment mode and policy. The entire process completes in milliseconds, ensuring security without impacting application performance.

GladiosWAF is designed to scale with your application.

Scaling is easy, add Intent Analysis in blocks of 25,000 for $5 each, with zero downtime.

There are no tier jumps or plan changes required — just simple, linear scaling based on your usage.

Yes. GladiossWAF gives you full control over what is sent for intent analysis.

Before sending a request to GladiosWAF, you can remove or modify sensitive fields such as tokens, cookies, or personal data.

This allows you to protect privacy and sensitive information while still letting the AI evaluate the parts that matter for threat detection.

Example (Node.js / Express):

                    
                        // Clone request data
                        const headers = {  ...req.headers };
                        const body = {  ...req.body };

                        // Remove sensitive headers
                        delete headers['authorization'];
                        delete headers['cookie'];
                        delete headers['x-api-key'];

                        // Remove sensitive body fields
                        if (body) {
                          delete body.password;
                          delete body.token;
                          delete body.credit_card;
                        };

                        // Send sanitized payload to GladiosWAF
                        const payload = {
                          method: req.method,
                          path: req.originalUrl,
                          headers,
                          body,
                       };
                  
                

Only the data you include will be analyzed and counted for Intent Analysis.

GladiosWAF returns standard HTTP status codes so it can be easily integrated into existing applications, APIs, and reverse proxies.

When a request is classified as non-malicious, GladiosWAF returns HTTP 200 (OK) and Non-Malicious, indicating the request is safe to proceed.

When a request is classified as malicious, GladiosWAF typically returns HTTP 403 (Forbidden) and Malicious, signaling that the request has been blocked due to security reasons.

In cases where the Intent Analysis service is unavailable or an internal error occurs, GladiosWAF may return HTTP 5xx status codes, allowing your application to decide whether to fail open (allow) or fail closed (block).

This predictable use of HTTP status codes makes GladiosWAF easy to integrate with load balancers, API gateways, CI/CD pipelines, and application middleware.

GladiosWAF achieves over 99% detection accuracy, validated against highly complex and highly obsfucated attack payloads generated by AI or human and live web traffic. Its model is continuously retrained to stay ahead of new vulnerabilities and attack patterns.

You can deploy GladiosWAF anywhere — as a SaaS API, on-premise, or on the Pocket WAF mini-PC for edge protection. All deployment models share identical AI protection capabilities.

Yes. GladiosWAF protects both web applications and APIs. It analyzes every HTTP request — whether it comes from a frontend web form, backend API, or mobile app — and determines if it’s safe in real time.

Unlike rule-based systems that trigger on simple keywords, GladiosWAF’s AI model analyzes context, intent, and structure of the entire request. This allows it to differentiate between legitimate parameters and truly malicious behavior, drastically reducing false positives.

GladiosWAF also gives you granular control over what data is sent for Intent Analysis. You can selectively remove sensitive headers, cookies, or body fields before forwarding a request to the AI model — ensuring both privacy and precision in detection.

GladiosWAF can detect and block:

• SQL Injection (SQLi)
• Cross-Site Scripting (XSS)
• Server-Side Request Forgery (SSRF)
• Local/Remote File Inclusion (LFI/RFI)
• Command Injection
• Directory Traversal
• Buffer Overflow and more

All request data is processed securely. Only hashed or anonymized logs are stored, depending on your plan. On-premise and Pocket WAF editions ensure complete data sovereignty and compliance.

Usage limits depend on your plan:

• Free: 1,000 Intent Analysis per month
• GladiosWAF Core: 25,000 Intent Analysis per month

Enterprise plans offer unlimited Intent Analysis and dedicated AI model inference.

Yes. GladiosWAF’s API can be embedded in DevSecOps pipelines to automatically test requests during deployment. This helps developers catch insecure inputs before production — adding AI-driven security to your CI/CD workflow.