Glossary term
WAF
Also: Web Application Firewall
Protection layer in front of web applications, mitigating OWASP top 10 attacks (SQLi, XSS, RCE, SSRF), bot traffic and volumetric attacks. Cloud WAF including CDN is standard in 2026; on-prem WAFs are the exception.
Cloud WAF leaders: Cloudflare, Akamai, AWS WAF, Azure Front Door + WAF, Imperva, F5 Distributed Cloud, Fastly. On-prem: F5 BIG-IP ASM, Imperva SecureSphere, Barracuda.
Extensions: API security (positive model via OpenAPI/GraphQL), bot management, account takeover protection, anti-fraud, client-side script protection (Magecart).
In practice
Audit cases: mandatory component for any internet-exposed application under NIS2, DORA, PCI DSS 4.0 (req 6.4.2). In banking often combined with DDoS mitigation and CDN.
Related terms
SASE
Gartner architecture category combining network (SD-WAN) and security functions (SWG, CASB, ZTNA, FWaaS, RBI) on a single cloud platform. SSE is the variant without SD-WAN.
SSE
Subset of SASE without SD-WAN. Bundles SWG, CASB, ZTNA and (increasingly) DLP/RBI in a cloud platform. Stand-alone Gartner Magic Quadrant exists.
Supply Chain Risk
Risks from the software and hardware supply chain: compromised open-source packages, build-pipeline attacks, updates with backdoors, sub-suppliers without audit trail. Mandatory under NIS2 Art. 21 (d) and DORA Art. 28 (sub-outsourcing).
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
BAIT
BaFin circular that concretises IT requirements for credit institutions. Specifies MaRisk AT 7.2 for IT strategy, information security, user permissions, project management, application development, and IT outsourcing.
BCM
Discipline for maintaining critical business processes during disruptions. Standards: ISO 22301, BSI Standard 200-4. Mandatory under BAIT/VAIT and DORA Art. 11 in the financial sector.