The WAF sits inline between clients and the server. Every request is checked against a signature database (regex-like pattern matching for known attack strings). A match gets the request blocked before it ever reaches the application.
- False positive — a legitimate request that happens to contain a suspicious substring (e.g. the word "SELECT" in normal prose) gets blocked anyway.
- False negative — a novel ("zero-day") attack pattern that isn't in the signature database slips through undetected.
- Raising sensitivity catches more attacks (including some zero-day-like patterns via heuristics) but also flags more false positives. Lowering it does the opposite.