Your opportunities

Impact

Potentially improve request inspection coverage. No monetary savings are asserted.

Effort & risk

Configuration review and staged rollout. Rules can block legitimate application traffic; review matches before enforcement.

Measure the outcome

Rescan after deployment and review false positives and application error rates.

Assumptions

• Deployment absence does not prove an attack occurred.
• Paid entitlement and commercial value require separate confirmation.

Evidence

• Zone inventory

  Fictional active zone: assets.example.com.

• Customer confirmation

  Fictional customer marked this scope production and non-test.

• Zone managed-WAF entrypoint

  Fixture confirms readable zone scope with no effective deployment.

• Applicable account managed-WAF entrypoint

  Fixture confirms readable account scope with no applicable deployment.

• HTTP analytics

  500,000 eyeball requests; 12 GB response bytes; seven complete UTC days; unsampled fixture.

Impact

Potentially reduce origin requests and bandwidth. Cost evidence is needed to estimate savings.

Effort & risk

Application and cache configuration review. Incorrect caching can serve stale or private content. Keep authenticated and private responses excluded.

Measure the outcome

Compare origin-contact share in equivalent seven-day windows after the change.

Assumptions

• MISS, EXPIRED, and REVALIDATED indicate origin contact, not guaranteed avoidable traffic.
• The cohort is confirmed public and static; intentional bypass is excluded.
• MISS/EXPIRED traffic persists on at least three distinct days in the cohort, not necessarily for the same object.
• The owner confirmed that purges, deployments, development mode, or cache-policy changes do not explain the window’s misses.

Evidence

• Zone inventory

  Fictional active zone: assets.example.com.

• Customer confirmation

  Fictional customer marked this scope production and non-test.

• HTTP analytics

  500,000 eyeball requests; 12 GB response bytes; seven complete UTC days; unsampled fixture.

• Cache cohort and configuration review

  200,000 confirmed public static requests; 116,000 origin contacts; 105,000 MISS/EXPIRED. Repeated misses and cache intent confirmed; private/API/auth traffic excluded.