Overview

A successful Proof of Concept (POC) should demonstrate how effectively a security solution protects an organization's actual applications, rather than relying solely on generic demonstrations or marketing claims.

The GAJWAF Running a POC / Evaluation Playbook provides a structured approach for GajShield solutions engineers and channel partners to plan, deploy, demonstrate and evaluate GAJWAF in a prospective customer's environment.

The playbook focuses on demonstrating application security capabilities, validating detection results, reviewing day-to-day administration and documenting measurable outcomes.

The guiding principle is simple: Detect First. Enforce with Consent.

By initially operating GAJWAF in Detect mode, evaluation teams can observe security findings without enabling GAJWAF's request-blocking actions. Enforcement is introduced only after reviewing false positives and obtaining the customer's explicit agreement.

What You'll Learn

The playbook provides five essential stages for conducting a GAJWAF evaluation.

Step 1: Define the POC Scope and Success Criteria

Before beginning the evaluation, agree on the scope and expected outcomes with the prospective customer.

The playbook explains how to document:

  • The website or application selected for evaluation.
  • The backend application infrastructure.
  • The attack categories to be demonstrated.
  • The duration of the evaluation.
  • Clear, measurable success criteria.

Establishing these requirements helps ensure that both parties evaluate the results against the same expectations.

Step 2: Deploy GAJWAF in Detect Mode

Learn how to place GAJWAF in front of the selected application or a staging environment.

The guide explains how to:

  • Configure the protected application's hostnames.
  • Define the backend application server.
  • Enable Detect mode.
  • Verify application connectivity and health.
  • Confirm that requests are passing through GAJWAF.

Detect mode allows security events to be observed without enabling the corresponding blocking actions.

Step 3: Demonstrate Application Security Capabilities

The playbook identifies six categories of security testing that can be demonstrated during the POC.

1. Injection Attacks

Demonstrate detection of common application attacks, including SQL injection, cross-site scripting, path traversal and command injection.

2. API Abuse

Evaluate API security controls against unexpected HTTP methods, schema violations and unauthorized or undocumented endpoints.

3. Bots and Automation

Demonstrate bot detection and browser verification capabilities against automated requests.

4. Application-Layer Floods

Evaluate rate limiting and Under-Attack Mode behavior for excessive HTTP requests and application-layer traffic floods.

5. Data Leak Prevention

Demonstrate response inspection and detection of configured sensitive-data patterns.

6. Reconnaissance

Show how GAJWAF identifies suspicious scanning and reconnaissance activity directed at protected applications.

The objective is to demonstrate relevant security capabilities against the agreed application and capture the resulting security events as evaluation evidence.

Step 4: Demonstrate the Administrator Experience

Security effectiveness is only one part of a successful evaluation. Prospective customers should also understand how the solution will be operated after deployment.

The playbook recommends demonstrating:

  • Overview Dashboard: A consolidated view of application security activity.
  • Per-Site Insights: Detailed visibility into individual protected applications.
  • Security Events: Evidence of suspicious activity and associated detection actions.
  • Compliance Reports: Security reporting capabilities for operational reviews and audits.
  • False-Positive Management: How administrators investigate and refine security policies without unnecessarily weakening protection.

This stage helps the customer assess the product's operational usability in addition to its security capabilities.

Step 5: Demonstrate Blocking with Customer Approval

If the prospective customer wishes to evaluate active security enforcement, GAJWAF can be switched from Detect mode to Block mode after appropriate preparation.

The playbook requires:

  1. Obtaining explicit customer approval.
  2. Reviewing and resolving identified false positives.
  3. Enabling Block mode for the agreed application.
  4. Verifying the resulting security behavior.

Important: Never enable blocking on a customer's production application without explicit authorization and an appropriate false-positive review.

Handling Competitive Evaluations and Bypass Claims

The playbook also explains how to investigate situations where a customer or competing vendor reports that GAJWAF has been bypassed.

Before interpreting a test result, administrators should verify that:

  • The application was operating in Block mode when blocking was expected.
  • The tested endpoint was not covered by an intentional security exclusion.
  • The request targeted a hostname configured for protection.
  • The request actually passed through GAJWAF rather than reaching the backend directly.

A fair evaluation should use an agreed configuration, clearly documented security policies and reproducible test cases.

Security findings should be investigated based on the actual request path, configuration and enforcement outcome.

Why This Playbook Matters

A well-managed POC helps customers make informed purchasing decisions based on observable results.

Following this playbook helps GajShield teams and partners:

  • Conduct structured and repeatable product evaluations.
  • Demonstrate security capabilities against customer applications.
  • Reduce unnecessary operational risk during testing.
  • Establish measurable success criteria before the evaluation.
  • Present real security events rather than unsupported performance claims.
  • Demonstrate security administration and reporting capabilities.
  • Handle technical objections and reported bypasses systematically.
  • Document customer approval before enabling enforcement.
  • Produce a clear evaluation outcome for customer sign-off.

POC Documentation and Sign-Off

The playbook includes a POC Scope & Sign-Off Sheet that can be completed jointly by the GajShield representative and the prospective customer.

The template captures:

  • Customer and application details.
  • Evaluation environment and duration.
  • Agreed success criteria.
  • Attack categories tested.
  • Observed and blocked results.
  • Supporting event IDs and technical observations.
  • Customer approval for Block mode.
  • False-positive review status.
  • Final evaluation outcome.
  • Signatures from both parties.

This provides a consistent record of what was tested, what was demonstrated and whether the agreed objectives were achieved.

Download the Playbook

Document: GAJWAF Playbook – Running a POC / Evaluation
Document Version: 1.0
Document Type: Pre-Sales and Technical Evaluation Playbook
Publication: October 2026
Pages: 7
Intended Audience: GajShield Solutions Engineers and Channel Partners

Attachment: GAJWAF_Playbook_Running_a_POC.pdf

Download the attached PDF for the complete five-step POC procedure, recommended security demonstrations, competitive evaluation guidance and the POC scope and sign-off template.

Related Documentation

For additional guidance, refer to:

Technical Support

For assistance with GAJWAF POC planning, evaluation environments or security testing, contact GajShield Technical Support or your authorized GajShield representative.

Website: https://www.gajshield.com

GAJWAF: Different Applications. Different Protection. Shared Risk Intelligence.