Attack signature updates.

false positives with (attack) signatures is an issue with any type of device, a WAF like the ASM module or a firewall IPS module. be honest against your customer and explain that some requests might be blocked which were no attacks. if you want security and use attack signatures you will need to accept that.

but you can make the risk smaller as explained by Jinshum, of course putting them trough testing is nicer, but can you test well enough?