WAF, EDR, and SOC/SIEM: Understand the layers of protection every company should have

WAF, EDR, and SOC/SIEM protect different and complementary parts of a company. A WAF (Web Application Firewall) protects web applications against attacks such as SQL Injection and XSS; EDR (Endpoint Detection and Response) monitors and responds to threats directly on devices (laptops, servers); and SOC/SIEM centralizes monitoring and incident response across the entire infrastructure, 24 hours a day.

Cybersecurity August 28, 2026 4 min read By: Skyone

None of the three layers replaces the other; together, they form a defense in depth that follows the NIST Cybersecurity Framework cycle: identify, protect, detect, respond, and recover.

WAF (Web Application Firewall): protecting web applications

A WAF (Web Application Firewall) is a security layer positioned between users (including hackers and bots) and application servers, filtering malicious HTTP/HTTPS traffic before it reaches the system. Its main results include:

Protection against the most common attack vectors, listed in the OWASP Top 10 (such as SQL Injection and Cross-Site Scripting).
Detection and prevention of accesses made by bots and malicious scripts.
Protection against distributed denial-of-service (DDoS) attacks.

EDR (Endpoint Detection and Response): protecting devices

While WAF protects the "entry point" of applications, EDR focuses on endpoints (laptops, desktops, and servers) using machine learning and AI techniques to detect anomalous behavior, including fileless threats ( those that do not leave behind a traditional malicious file to be identified). Expected results include:

Improved detection of advanced threats.
Reducing Average Response and Recovery Time (MTTR)with automated responses.
remediation automation across Windows, Mac, and Linux systems.

SOC/SIEM: the continuous monitoring center

The SOC (Security Operations Center) with SIEM (Security Information and Event Management) centralizes the collection and processing of telemetry data and events from the entire infrastructure, operating 24 hours a day, 7 days a week. This includes:

Proactive threat detection, based on recognized frameworks such as MITRE ATT&CK and the identification of anomalous behavior.
Response to security incidents, with the deployment of specialists for containment and remediation activities.
Centralized processing and visibility of all monitored assets.

How the three layers complement each other

Layer	What protects	When it comes into action
WAF	Web applications (websites, web systems)	Blocks attacks before they reach the application server
EDR	Endpoints (notebooks, desktops, servers)	Detects and responds to suspicious behavior directly on the device
SOC/SIEM	All the infrastructure, in a centralized way	Continuously monitors and coordinates incident response at any layer

Where should a company begin?

There is no mandatory order, but the starting point is usually a threat analysis, which discovers and evaluates the security posture of URLs and IPs exposed on the web, identifying vulnerabilities and prioritizing risks before deciding which layers of protection to implement first.

You may also be interested in: Cybersecurity and the evolution of cyberattacks

Frequently Asked Questions

Does a small company need all three layers (WAF, EDR, and SOC/SIEM) at the same time? It depends on the level of exposure and criticality of the systems. Ideally, you should start with a threat analysis to understand where the greatest risks lie, and prioritize the protection layers based on this diagnosis, rather than implementing everything at once without criteria.

Are WAF and Network Firewall the same thing? No. A Network Firewall protects network traffic as a whole, controlling unauthorized access at the network level. A WAF, on the other hand, is specific to web applications, focusing on attacks that exploit vulnerabilities in the application's code or behavior.

What does "fileless threat detection" mean in the context of EDR? These are attacks that do not rely on a traditional malicious file to install themselves on the system, operating directly in memory or exploiting legitimate tools already present on the device, therefore requiring behavior-based detection, not just file signature detection.

Does a SOC/SIEM replace the need for WAF and EDR? No. The SOC/SIEM centralizes monitoring and response, but it depends on the data and alerts generated by layers such as WAF and EDR to have complete visibility; the three function in a complementary, not substitutive, way.