Your Azure WAF dashboard shows green, but every attack is hitting your backend. The culprit? Detection mode - the default setting that logs attacks without blocking them. When a request matches a rule in Detection mode, the WAF logs it as a 'Block' but still forwards the request to your application unchanged.

This creates a dangerous illusion of security. A request with an SQL injection payload triggers a Critical rule match, accumulates 5 points on the OWASP anomaly scale, and gets logged. In Prevention mode, that same request would be blocked with a 403 response. In Detection mode, the attacker gets through. The engine inspects, logs, and then does nothing.

The default trap is intentional but problematic. Microsoft recommends starting in Detection mode to tune out false positives, but provides no mechanism to force the transition to Prevention. Teams deploy WAFs, review alerts, create exclusions, and move on. Detection mode becomes permanent not through choice but through inertia. What makes this particularly insidious is that Detection mode offers no signal that attacks are succeeding.