For five consecutive years, Aliyun has been ranked number one in the Chinese cloud WAF market, leading the new paradigm of Agentic application security with WAAP.

International authoritative research institution IDC recently released the "IDC MarketScape: China's WAAP Vendor Assessment Based on Large-scale Security Models in 2026". With the integrated WAAP capabilities on cloud, multi-cloud, and hybrid cloud, as well as native innovations in AI/Agent application security direction, Alibaba Cloud ranks in the "Leaders" quadrant, leading in product capabilities, strategy, and market share. At the same time, IDC's market share report shows that Alibaba Cloud's WAF has been leading the public cloud WAF market in China for five consecutive years. IDC points out that the Chinese WAAP market has evolved into two paths: the "unified platform, integrated architecture" route represented by public cloud vendors, integrating API security, large-scale model security, Bot management, and DDoS capabilities; and the solution route provided by security vendors. With the rapid development of large-scale models, "enhancing WAAP with large-scale models" and "protecting large-scale model applications" have become the focus directions of the entire industry. The core strengths of Alibaba Cloud WAF are reflected in four aspects. On the access side, it supports unified security management on cloud, multi-cloud, and hybrid cloud, natively integrating cloud products such as ALB, MSE, FC, CLB, ECS, and providing a "reverse proxy + service SDK" solution for hybrid clouds. On the protection side, it automatically deploys whitelists through multi-dimensional analysis of payloads by large models to reduce false positives, improves API sensitive data recognition accuracy through context correlation, and automatically detects hidden features in traffic to combat advanced Bots. For large-scale model applications, the product natively supports real-time detection with SSE protocol, integrates AI security guardrails with the mindset of "protecting model applications with models", identifies and blocks prompt word injections and role escalations, and prevents API abuse from depleting inference resources. In terms of cloud-native elasticity, WAF supports on-demand scaling, has been tested in scenarios of millions of QPS per second for top customers, and continuously ensures the smooth operation of large-scale events such as "Double 11". In 2026, Alibaba Cloud WAF intensively released Agentic capabilities: Security operation Agents cover Web core protection, Bot protection, scanning protection, and custom rules, shortening rule optimization from days to minutes; Agentic API security leverages AI baseline engine to automatically learn API structures, achieve real-time desensitization and cross-border compliance automation; Agentic Bot management introduces workflow learning and graph model analysis, automatically clustering same-origin groups; AI application protection provides zero-code gateway access, offering out-of-the-box templates for prompt word injections, unauthorized calls, and sensitive data leakage. Currently, the above capabilities have been successfully verified in various leading industries. A new energy vehicle company used Agentic API security for GDPR audits in cross-border business; a leading sports brand reduced manual intervention scenes by about 70% using security operation Agents; a leading basic model company established a model guardrail for large-scale inference services using AI application protection capabilities. From integrated WAAP to Agentic application security driven by security large models, Alibaba Cloud's response directly addresses the industry trends revealed by IDC. Alibaba Cloud WAF will continue to focus on "platformization + Agentization" to help customers build a secure foundation for applications that is adaptable, operational, and measurable in the AI era.