A web application firewall that shows its work.
DAV NGWAF runs on your own Linux server. It scores every request with signature rules and a neural network, blocks attackers at the network layer, and records each decision so you can check it.
In production since late 2025. Developed under practices aligned with ISO/IEC 27001.
How it works
Each layer does one job, and every layer leaves a record. The engine, the dashboard and the edge configuration are delivered together as one tested product.
Edge
Receives the request, records the real client address, and passes it to the engine. DAV NGWAF ships with the edge configuration for both web servers.
Signatures
Fast pattern rules catch known attacks such as SQL injection, path traversal and scanner fingerprints.
Neural network
A CNN-GRU model in the Rust engine reads the request as a sequence and judges its shape, so it catches variations no rule was written for. It runs on the CPU, on x86 or ARM, with GPU acceleration as an option.
Classification
Detections are matched against a pattern database, so each event tells you what technique was attempted.
Enforcement
Attacking addresses go into ipset or nftables sets, with XDP kernel-level drop available, so later traffic never reaches your web server.
DAVSOC
Every detection lands in the security operations dashboard and in scheduled HTML and PDF reports built from the logs themselves.
Three ways to run it
Start small and add depth when you need it.
Log parsing
Reads logs directly and produces evidence reports with no database. The smallest footprint, with results right away.
Database backed
Stores events in PostgreSQL for history, correlation across web, SSH and mail, and views across several servers.
Analyst extension
Adds a Python data science environment for your own analysis of the collected events.
Is DAV NGWAF a fit?
It's built for people who run their own Linux servers and want to see and own their defenses.
A good fit if you
- Run self-managed Linux servers, on premises or on AWS and other IaaS
- Need more visibility than a vendor dashboard gives you
- Need evidence for governance, compliance or risk reviews
- Prefer local enforcement with ipset or nftables
- Want to own the system instead of renting a subscription
What we don't do
- Collect, sell or analyze your traffic on outside servers
- Run a 24/7 outsourced security operations center
- Offensive security or penetration testing
- Take control of infrastructure outside the agreed scope
Everything is installed on your own servers, and you keep full control of it.
Evidence, not promises
DAV NGWAF protects our own production servers, including our AWS server. These are results from that traffic.
- Architecture and production analysis Full WAF architecture, deployment configuration and analysis of production traffic (PDF)
- CNN-GRU two-layer IDS report Design of the dual-layer intrusion detection system, the model architecture and validation results (PDF)
- Live WAF verification reports Generated hourly from our AWS server's own detections .
- Live SOC dashboard, on request See DAVSOC working on our own traffic with a guided, view-only login. Ask through the contact form.
These documents are published for transparency and technical review. Results on your traffic will differ, and they are not an offer of sale.
Licensing
Three ways to license DAV NGWAF, depending on how much control your organization needs.
| License | What you get | Good for |
|---|---|---|
| Business | The compiled DAV NGWAF product, licensed to your server | Small and mid-sized businesses protecting their own sites |
| Enterprise | The compiled product plus encrypted source, with quarterly pattern updates built on site | Organizations that need to build and audit inside their own environment |
| Source and white label | Full source access | Acquisition or reselling under your own brand |
All licenses run for a minimum of one year. Reports, data science and the full SOC dashboard are available as add-ons. Contact us for pricing.
How an engagement runs
Every installation uses the same core product, tailored to your servers, services and compliance needs.
Review
We look at your servers and threats and agree on the scope in writing.
Install
We install DAV NGWAF, the edge configuration and DAVSOC on your own systems.
Validate
We confirm detections and enforcement against real traffic and hand over the runbook.
Report and maintain
Pattern updates, reports and, if you want it, ongoing server care through Pema Hosting.
Tell us what you need to protect
Send a short note about your servers and goals. You'll get a reply from a person, with no mailing lists and no automated follow-ups.