A pre-configured retail WAF solution typically has at least 85% of configuration done for you. As the end-user, you will end up having a few drop-down menus here and there, all laid out in an elegant and very easy-to-use management dashboard. There's very little actual control over security. In simple terms, you end up surrendering some quality of your security in return for a lower price. You trust the 85% they have done for you. You can take for granted, it's either too restrictive and bulky policy which ends up slowing your application due to a number of irrelevant security checks, or it's too loose, providing very little actual security benefit. And if you are not happy with that one-size-fits all glove, you will pay for additional exceptions and extended control.
If cost aspect should be ignored, then I'm not sure if I understand your question. There is not a single security benefit of having just one piece of protective glove for every application out there. Self-managed WAF with a fully 'customized for application' security policy wins all the time, every time, in every security aspect, or by minimum is on par in some aspects. I don't think this list would have much meaning, so best to disregard security aspect and focus on others - manageability, cost (one-time product + on-going management) and do not forget the most important one - degradation of app performance. The last one in particular is something you should clarify before signing any contracts. The best WAF policy is the one that offers all the relevant-for-your-application protection with minimal degradation of app performance.
Nimbostratus
