WAF shouldn't be the only line of defence. It's just another layer in the security onion.