Nowadays web application firewalls are capable of identifying and neutralizing sophisticated threats. They employ the finest methods of machine learning and decision making algorithms. As a result, more and more companies purchase and deploy them to protect their assets. The market is becoming saturated with the products that boast a slew of attractive features and promise near total protection. Are web application firewalls worth their costs? Are they as secure as their vendors claim? Can they fulfill their role in layered security architecture? To what degree does their effectiveness depend on a proper configuration? How can the management be assured that web application firewalls ultimately make the information more useful, available, resilient and confidential?