When it comes to web security, many companies still believe that a traditional firewall is enough. For years, it was — because most attacks targeted infrastructure. Today, reality is different: web applications concentrate business logic and are the primary target for attackers.