Security Guru Question

We are using the ASM module for our web application to help protect common web security vulnerabilities (i.e OWASP).

 

 

During web penetration and vulnerabiltiy assessment, would you recommend that we turn on or off the ASM? What is a good strategy?

 

 

Thanks.