The comparison of AWS WAF to Sophos could not be more misleading. It’s an engine for building a limited set of HTTP exploit detections, and has nothing to do with endpoint protection whatsoever.