That creativity takes time. WAFs are the first line of defence, buying some time for fixing the actual vulnerabilities.