Skip to content
nexarqAI

Delivery evidence

Complex estates.
Considered changes.

Selected migration work. Client identities withheld.

Mobility platform / Edge migration

31 hostnames. One coordinated edge migration.

Starting point

3 separate systems

WAF on 4 of 31 hosts

Engineering deliveredRebuild effective rulesVerify 214 redirectsPrepare certificates
Result

31 hosts migrated

WAF across the estate

31hostnames migrated
214redirects verified
4 → 31hosts with WAF coverage

The constraint

Traffic was split across three systems, with WAF protection covering only four of 31 hostnames.

The engineering decision

Rebuild rules from the source export, account for first-match behaviour, and verify redirects and certificates before cutover.

Consolidated edge configuration. Certificate ready before nameserver cutover.

Discuss a similar scope

Inside a cutover record

Reusable checklists for this type of work. These are blank working templates, not the client’s project records.

nexarq / parity checksWorking template

Edge migration behaviour checklist

Compare source and target behaviour before moving application traffic.

BehaviourCompare on source and targetPass condition
RedirectsStatus code, destination, query string handling and rule order.Each agreed test URL returns the expected status and location.
ProtectionEffective action, rule priority and exception scope.Test traffic receives the intended action; authorised exceptions remain bounded.
CachingCache key, bypass conditions, expiry and invalidation.Cacheable responses hit as expected; private responses are not cached.
Origin routing and TLSOrigin selection, host header, SNI and certificate validation.The intended backend responds over the approved TLS path.

Before you close the record

  • Results reference request traces or captured headers.
  • Differences are resolved or explicitly accepted by the application owner.
  • Parity is checked by behaviour, not by matching rule counts.

This is a reusable migration worksheet, not a result from the case studies shown on this site.

Enterprise estate / WAF policy migration

A WAF migration grounded in behaviour parity.

Starting point

232 applications

Inherited policies & exceptions

Engineering deliveredAssess 861 managed rulesMap 71 exceptionsResolve policy conflicts
Result

Migration plan

Application-by-application

232applications
861managed rules assessed
71exceptions mapped

The constraint

Templates and undocumented exceptions obscured which security controls actually enforced and which only alerted.

The engineering decision

Review effective policy behaviour, map managed rules and exceptions, and resolve conflicting controls before migration.

Mapped exceptions, assessed rules and recorded policy decisions.

Discuss a similar scope

Inside a policy review

Reusable checklists for this type of work. These are blank working templates, not the client’s project records.

nexarq / exposure registerWorking template

Public application exposure register

Record how a public application can be reached, which controls apply, and what needs to be fixed.

Entry pointWhat to verifyRecord before closing
Login endpointCompare failed logins, successful sign-ins and challenge results over the same period.Affected path, evidence link, account-abuse control and assigned owner.
API endpointCheck authentication, request limits and whether the limit applies to the intended identity.Method and path, observed limit, expected behaviour and remediation ticket.
Origin addressCheck whether the application accepts direct traffic that bypasses the approved edge path.Test source, response, allowed ingress paths and retest result.

Before you close the record

  • Every open finding has an affected asset, evidence link and owner.
  • Priority reflects business impact and exposure, with the reason recorded.
  • Closed findings include a retest; accepted risks name the approver and review date.

Use this as an assessment worksheet. The entries describe checks to perform, not findings from a customer environment.

Let’s build what’s next

Your next move.
Engineered by Nexarq.

What needs to change in your business?

Talk to us