I've used Mod_Security previously and I must tell you it is quite efficient against basic types of attacks. Being a penetration tester, I would suggest that you implement mod_security preliminary and test your product for vulnerabilities.