A few days ago I watched a developer on r/aws work through his first real month of production billing. The compute was fine. The database was fine. The unexpected line was the firewall: he was paying, per request, to inspect and reject traffic from bots that cost their operators very little to send. His verdict was that firewall pricing can feel like a tax on having a public API. The frustration reflected a real cost asymmetry.
Why the defender pays to inspect the attacker’s traffic
Underneath his complaint is a question worth examining: why does the defender pay to inspect the attacker’s traffic? Bandwidth, storage and compute have generally become more cost-efficient over time, but the cost of screening unwanted traffic still scales with request volume.
It is easy to frame this as a pricing problem, and I understand the reaction. I’ve had it myself. But the numbers point to a more useful explanation. Thales’ 2026 Bad Bot Report puts automated traffic at 53 percent of all web traffic in 2025, with human traffic at 47 percent. It also reports that 27 percent of bot attacks target APIs directly. Public endpoints now operate in a traffic mix where machines are often the norm. Whatever the inspection model, providers and customers are dealing with a large share of requests that will never become genuine users.
What that looks like on AWS
Here is how that terrain appears in AWS, our speciality at DNX. AWS prices its Web Application Firewall (WAF) at 60 cents per million requests inspected, plus five dollars a month for the web Access Control List (ACL) and a dollar per rule. Bot Control adds usage-based charges after the included free tiers, up to ten dollars per million requests on the targeted tier. These are standard managed-service charges, but they create an operational challenge: unwanted requests still need to be inspected, while the sender can generate traffic at very low cost. The industry has a name for abuse of that asymmetry: Economic Denial of Sustainability (EDoS), where traffic is used to increase the cost of operating defensive controls.
Build the outer wall before you build the keep
Walled cities worked this problem out centuries ago. You do not post your most expensive guard at the outer gate to interview every traveller on the road. You build efficient outer defences that turn away the obvious, and you save the detailed inspection for the few who reach the keep. Many WAF deployments I review are optimised for coverage first rather than cost efficiency: default rule ordering and advanced bot analysis applied more broadly than needed, sometimes even to static assets. Sequenced properly, lower-cost verdicts run first. Geographic rules, IP reputation lists and rate limits can filter commodity noise before advanced inspection is invoked. Traffic filtered at the wall does not need to proceed to the keep.
Two shortcuts that don’t hold up
Two common shortcuts deserve a warning. The first is geo-blocking everything outside your market. It can help if your product serves a single country, but recognise its limit: it is volume hygiene rather than a complete control, because residential proxy networks have exits inside your borders. The second is the new wave of proof-of-personhood hardware, iris-scanning orbs included, promising to verify a human before a session begins. For a consumer login page there is at least an argument. For an API it answers the wrong question. The developer in that thread sells an automation framework; his paying customers are bots. The job was never to keep machines out. It is to tell invited machines from uninvited ones, and that is authentication: keys, signatures, quotas. Unglamorous, decades old, and it works.
The bill is a signal, not a tax
So, why does the defender pay to inspect the attacker’s traffic? Because the terrain changed and the default architecture did not. The web became majority-machine around 2024, while many common designs still assume a human internet with occasional automated noise. Per-request pricing did not create that mismatch. It simply makes the cost visible.
Which is the reframe I offer anyone who brings me a higher-than-expected WAF bill: it is a useful security signal. It shows, in dollars, where rule ordering and inspection scope may be improved. Lower-cost verdicts first. Advanced inspection only where the risk justifies it. Credentials for machines instead of humanity tests for their owners.
About the author
Shannon Zorn is DNX Solutions’ Security Practice Leader. He brings 24 years in cybersecurity, including service with the U.S. Department of Defence and a role leading the IMPACT Lab’s cybersecurity practice at Radford University. At DNX, he sets the strategic direction for the security practice, keeping it aligned to current cloud technologies and best practice. Zorn is a U.S. Army and Air Force veteran, known for direct decision-making under pressure.
Your WAF bill just told you something. Want to know what?
DNX runs Security Posture Reviews for teams who want clarity on where their defences are working and where they’re just adding cost. We’ll show you what’s driving your inspection spend and where tighter rule ordering can bring it down.
