--- title: "WAF, IPS, and DLP: Why Content Inspection Testing Is Harder Than It Looks" description: Explore the challenges of evaluating WAF, IPS, and DLP solutions, highlighting the importance of realistic testing methodologies for optimal security performance. image: https://test4net.com/hubfs/AI-Generated%20Media/Images/Layered%20Document%20Inspection%20with%20Scanning%20Lines%20and%20Amber%20Highlights.png --- [Skip to content](https://test4net.com/blog/waf-ips-dlp-content-inspection-testing#main-content) [![TEST4NET](https://test4net.com/hubfs/test4net-logo-fixed-2.svg)](https://test4net.com/?hsLang=en) - CLOUDLAB - SERVICES - SOLUTIONS - VENDORS - RESOURCES - COMPANY - [English](https://test4net.com/blog/waf-ips-dlp-content-inspection-testing) - [Русский](https://test4net.com/ru/blog/waf-ips-dlp-content-inspection-testing) - [Հայերեն](https://test4net.com/hy/blog/waf-ips-dlp-content-inspection-testing) [Login](https://lab.test4net.com) [Support](https://test4net.com/support?hsLang=en) - [English](https://test4net.com/blog/waf-ips-dlp-content-inspection-testing) - [Русский](https://test4net.com/ru/blog/waf-ips-dlp-content-inspection-testing) - [Հայերեն](https://test4net.com/hy/blog/waf-ips-dlp-content-inspection-testing) How It Works Remote access to a live test lab: pick a scenario, run it, get the report Equipment & Capabilities Traffic generators, emulators and DUT racks available in the lab Access Plans Hourly sessions, subscriptions and dedicated racks [Log in to CloudLAB POPULAR Your sessions, reservations and reports](https://lab.test4net.com) [Open the CloudLAB portal](https://lab.test4net.com) Network Test & Validation Load & Performance Testing Functional Testing Conformance Testing Interoperability Testing Security & Resilience Testing All testing services Automation & Expertise Test Automation & CI/CD Test Plan & Methodology Design Training Programs Lab & Equipment Lab Rental Hosted DUT Testing Equipment Repair Not sure where to start? Get a test plan for your setup Tell us what you run and what worries you. We propose the tests, tools and timeline. [Request a test plan](https://test4net.com/contacts?hsLang=en) By Technology By Industry By Task Routing & Switching Firewalls & NGFW SD-WAN & WAN Cloud & NFV 5G & Mobile Core Wi-Fi Storage & Infrastructure AI / Switching Fabric (RoCEv2) All technologies Telecom Operators Network & Security Vendors Banks & Financial Services System Integrators Enterprise IT Teams Managed Service Providers Media, Broadcast & Streaming Government & Public Sector All industries Pre-deployment Validation Vendor Selection Cloud Migration Readiness AI/GPU Cluster & RoCEv2 Readiness New Technology Rollout Troubleshooting & Benchmarking Disaster Recovery & Failover Testing SLA Validation & Vendor Accountability All tasks Testing Tools & Lab Ixia / Keysight POPULAR Emblasoft NEW Apposite Technologies T-Plan Cubro Candela Technologies Netitest How we integrate the tools IT Infrastructure HPE Vinchin Yeastar Become a partner Read Technologies / Protocols Methodologies [Blog Case studies, test insights and lab notes](https://test4net.com/blog?hsLang=en) [Industry News What is changing in network testing and infrastructure](https://test4net.com/news?hsLang=en) FAQ How the lab, sessions and reports work BGP Route exchange, policy and convergence OSPF & IS-IS IGP adjacency, flooding and SPF timing MPLS & Segment Routing LDP, RSVP-TE and SR-MPLS label paths EVPN / VXLAN Overlay fabrics, MAC/IP routes, multi-homing IPsec & IKEv2 Tunnel setup, rekeying and throughput TLS / HTTPS Handshakes, cipher suites and inspection RoCEv2 Lossless Ethernet, PFC and ECN for AI fabrics Wi-Fi 6 / 6E / 7 802.11ax/be, OFDMA, MLO and roaming All protocols [RFC 2544 Throughput, latency, frame loss and back-to-back](https://test4net.com/methodologies/rfc-2544?hsLang=en) RFC 2889 LAN switch benchmarking: forwarding, MAC learning, congestion [RFC 9411 / RFC 3511 Firewall and NGFW performance benchmarking](https://test4net.com/methodologies/rfc-9411-rfc-3511?hsLang=en) RFC 6349 TCP throughput and buffer delay testing RFC 5180 IPv6 benchmarking methodology ITU-T Y.1564 Ethernet service activation: CIR, EIR, KPIs per service ITU-T Y.1731 Ethernet OAM: delay, jitter, loss and SLA monitoring TR-398 Wi-Fi in-premises performance test plan All methodologies From the blog [![Wi-Fi testing](https://test4net.com/hubfs/blog-covers/menu/menu-wifi-640.webp) Wi-Fi Wi-Fi Testing for High-Performance Use Cases: Why a Walk Test Is Not a Test](https://test4net.com/blog/wi-fi-testing-for-high-performance-use-cases-why-a-walk-test-is-not-a-test?hsLang=en) [![Security validation](https://test4net.com/hubfs/blog-covers/menu/menu-security-640.webp) Security One Test Is Not Enough: Why Security Infrastructure Needs Continuous Validation](https://test4net.com/blog/security-platform-continuous-validation-updates?hsLang=en) [![Security product testing](https://test4net.com/hubfs/blog-covers/menu/menu-lab-640.webp) Methodology How to Run a Security Product Test You Can Actually Trust](https://test4net.com/blog/how-to-run-a-security-product-test-you-can-actually-trust?hsLang=en) [About Us Independent lab in Armenia, team and history](https://test4net.com/about?hsLang=en) [Why TEST4NET What you get that vendor slides never show](https://test4net.com/why-test4net?hsLang=en) Our Lab & Certifications Equipment, methods and the standards we test against Partner Program Resell, integrate and co-test with us [Contacts Talk to an engineer, not a sales bot](https://test4net.com/contacts?hsLang=en) [Support portal](https://test4net.com/support?hsLang=en) - CLOUDLAB How It Works Equipment & Capabilities Access Plans [Log in to CloudLAB POPULAR](https://lab.test4net.com) - SERVICES Network Test & Validation Load & Performance Testing Functional Testing Conformance Testing Interoperability Testing Security & Resilience Testing All testing services Automation & Expertise Test Automation & CI/CD Test Plan & Methodology Design Training Programs Lab & Equipment Lab Rental Hosted DUT Testing Equipment Repair [Not sure where to start? Get a test plan for your setup](https://test4net.com/contacts?hsLang=en) - SOLUTIONS By Technology Routing & Switching Firewalls & NGFW SD-WAN & WAN Cloud & NFV 5G & Mobile Core Wi-Fi Storage & Infrastructure AI / Switching Fabric (RoCEv2) All technologies By Industry Telecom Operators Network & Security Vendors Banks & Financial Services System Integrators Enterprise IT Teams Managed Service Providers Media, Broadcast & Streaming Government & Public Sector All industries By Task Pre-deployment Validation Vendor Selection Cloud Migration Readiness AI/GPU Cluster & RoCEv2 Readiness New Technology Rollout Troubleshooting & Benchmarking Disaster Recovery & Failover Testing SLA Validation & Vendor Accountability All tasks - VENDORS Testing Tools & Lab Ixia / Keysight POPULAR Emblasoft NEW Apposite Technologies T-Plan Cubro Candela Technologies Netitest How we integrate the tools IT Infrastructure HPE Vinchin Yeastar Become a partner - RESOURCES Read [Blog](https://test4net.com/blog?hsLang=en) [Industry News](https://test4net.com/news?hsLang=en) FAQ Technologies / Protocols BGP OSPF & IS-IS MPLS & Segment Routing EVPN / VXLAN IPsec & IKEv2 TLS / HTTPS RoCEv2 Wi-Fi 6 / 6E / 7 All protocols Methodologies [RFC 2544](https://test4net.com/methodologies/rfc-2544?hsLang=en) RFC 2889 [RFC 9411 / RFC 3511](https://test4net.com/methodologies/rfc-9411-rfc-3511?hsLang=en) RFC 6349 RFC 5180 ITU-T Y.1564 ITU-T Y.1731 TR-398 All methodologies From the blog [Wi-Fi Testing for High-Performance Use Cases: Why a Walk Test Is Not a Test Wi-Fi](https://test4net.com/blog/wi-fi-testing-for-high-performance-use-cases-why-a-walk-test-is-not-a-test?hsLang=en) [One Test Is Not Enough: Why Security Infrastructure Needs Continuous Validation Security](https://test4net.com/blog/security-platform-continuous-validation-updates?hsLang=en) [How to Run a Security Product Test You Can Actually Trust Methodology](https://test4net.com/blog/how-to-run-a-security-product-test-you-can-actually-trust?hsLang=en) - COMPANY [About Us](https://test4net.com/about?hsLang=en) [Why TEST4NET](https://test4net.com/why-test4net?hsLang=en) Our Lab & Certifications Partner Program [Contacts](https://test4net.com/contacts?hsLang=en) [Login](https://lab.test4net.com) [Support](https://test4net.com/support?hsLang=en) [All articles](https://test4net.com/blog) # WAF, IPS, and DLP: Why Content Inspection Testing Is Harder Than It Looks ![](https://test4net.com/hubfs/IMG_0070.jpg) [Alexander Zemskov](https://test4net.com/blog/author/az) July 10, 2026 7 min read ![](https://test4net.com/hs-fs/hubfs/AI-Generated%20Media/Images/Layered%20Document%20Inspection%20with%20Scanning%20Lines%20and%20Amber%20Highlights.png?width=1672&height=941&name=Layered%20Document%20Inspection%20with%20Scanning%20Lines%20and%20Amber%20Highlights.png) In this article *This is part three of a six-part series on evaluating network security products. [Part 1](https://test4net.com/blog/security-product-datasheet-gap?hsLang=en) covered the structural datasheet gap. [Part 2](https://test4net.com/blog/ngfw-testing-fast-path-appmix-pcap?hsLang=en) covered NGFW-specific testing traps.*   WAF, IPS, and DLP platforms are frequently purchased on the strength of vendor demos and detection rate claims. They are also among the most frequently disappointing in production — not because the technology does not work, but because the testing methodology used to select them did not reflect the conditions they would operate under. ## WAF: What "Requests Per Second" Does Not Tell You Web Application Firewall performance figures — requests per second, throughput, latency — are almost universally measured under conditions that have little to do with production web application traffic.   **The synthetic request problem.** Most WAF test setups use a fixed set of HTTP/HTTPS requests, either synthetic or drawn from a limited PCAP capture. Every request follows the same structure: same headers, same cookie format, same URI pattern. Real web application traffic is the opposite: dynamic session tokens on every request, variable content lengths, authentication flows that span multiple requests with state tracked across them, redirects, varying TLS session characteristics. A WAF rule engine that processes a uniform synthetic request stream has a fundamentally easier job than one processing the actual output of a modern web application.   **Attack isolation vs. attack-in-traffic.** WAF detection accuracy figures are nearly always measured by sending attack payloads in isolation: a clean test session with one malicious request, response recorded, detection confirmed. What this does not test is whether the WAF maintains the same detection accuracy when attack payloads are embedded within a high-volume stream of legitimate application requests. Under load, with the rule engine processing thousands of concurrent sessions, detection accuracy for subtle injection attempts and low-signal evasions can degrade. Test both: isolated attack detection, and attack detection embedded at realistic rates within a background traffic load.   **TLS inspection under concurrency.** Many WAF deployments include TLS termination or full man-in-the-middle inspection. Vendors frequently report TLS and non-TLS performance separately and present the better number. The performance impact of TLS termination, certificate validation, session resumption handling, and re-origination at high concurrency is where the production number lives. Test with your realistic TLS connection rate, your typical session duration, and with TLS inspection active.   **Rule set complexity matters.** A WAF with the baseline rule set and a WAF with the baseline rules plus custom virtual patching for a dozen applications plus exception rules accumulated over two years of operation are running different workloads. Performance testing with a minimal rule set does not predict behavior under your production policy.   ## IPS: The Evasion Gap That Detection Rates Hide Intrusion Prevention Systems are evaluated almost entirely on detection rate. This is a metric that is easy to measure, easy to present, and largely disconnected from the protection that matters.   **Detection rate is a circular measurement when the test tool is known.** An IPS that detects 99% of attacks drawn from a library the vendor prepared against will produce a 99% detection rate in a test using that library. The measurement tells you the device recognizes attacks it was trained to recognize. This is useful, but incomplete. The more important question is: what happens to attacks that use evasion techniques the vendor did not specifically train for?   **Evasion coverage is where products diverge.** Evasion techniques — payload fragmentation, protocol ambiguity exploitation, encoding variations, polymorphic shellcode, header manipulation — are how real attackers bypass signature-based detection. An IPS that blocks 99% of direct attacks but fails against 30% of evasion-wrapped variants of those same attacks provides substantially less protection than its headline number implies.   The only meaningful way to test evasion coverage is with an attack emulation platform that generates attacks dynamically with controlled variation in encoding, fragmentation strategy, and protocol handling — not a static replay of known payloads. Static PCAP-based attack testing gives the vendor advance knowledge of every payload. That is not a security test; it is a rehearsal.   **Detection under load.** At 20% utilization, an IPS engine can afford to be thorough. At 80% utilization under sustained attack alongside heavy legitimate traffic, the same engine may start making triage decisions: dropping packets, reducing inspection depth, or deferring classification. Testing IPS detection rate at idle tells you the ceiling. Testing it at 70–80% of rated throughput tells you what your users will experience under the conditions where an attacker is most likely to operate.   ## DLP: The Most Consistently Oversold Category in Security Data Loss Prevention is where the gap between vendor claims and production reality tends to be widest, and where the consequences of a failed evaluation are most operationally costly.   **The false positive problem at scale.** DLP accuracy figures from vendor testing are measured against clean test datasets: purpose-built documents with clearly structured sensitive data, or small controlled corpora. False positive rates in this environment look acceptable — 1–3% is common in vendor materials.   Production environments do not have clean, controlled document corpora. They have years of accumulated files in dozens of formats, with complex embedded content, legacy templates that match data patterns without containing actual sensitive data, and business-specific terminology that overlaps with sensitive data definitions. Against a realistic enterprise content sample, false positive rates that appeared manageable in testing can reach levels that generate hundreds of incidents per day — making the system operationally unusable without months of tuning.   Ask vendors to run their DLP detection against a sample of your actual document repository during evaluation. The difference between controlled-test accuracy and production-realistic accuracy is the number that matters.   **Throughput under real content inspection.** DLP requires application-layer content analysis of file payloads — not packet inspection. This is computationally expensive, and the cost varies enormously by file type. A DLP engine processing a stream of plain text emails operates at much lower overhead than one processing a stream of large Excel workbooks with embedded macros, nested ZIP archives, or heavily formatted PDFs.   Vendor throughput figures are almost always measured against lightweight content. Test with a realistic file type distribution representative of what your organization actually moves across the network. The throughput number may look very different.   **Protocol coverage: what "DLP" actually covers.** Enterprise data exfiltration does not confine itself to SMTP and HTTP uploads. Modern environments involve Teams, Slack, Zoom file transfers, cloud sync clients (OneDrive, Google Drive, Dropbox), custom SaaS upload flows, and a long tail of proprietary protocols. Ask the vendor to enumerate which protocols receive full content inspection versus metadata-only monitoring versus no coverage. The distinction matters significantly for what the platform actually protects against.   ## Shared Principle: Test the Thing You Are Actually Buying Across WAF, IPS, and DLP, the same principle applies: the test must reflect the conditions the product will operate under in your environment.   That means:   - The traffic or content used in testing must resemble your actual application traffic, your actual document corpus, your actual attack surface - Security function testing must occur under realistic load, not at idle - The feature configuration tested must match what will run in production — not a minimal default that produces favorable benchmark numbers - Results must be granular enough to understand what drove them — not a single aggregate figure None of this requires unusual methodology. It requires asking clearly what conditions produced each number in a vendor's test results — and independently verifying the answer.   *Next in this series — Post 4: SASE — why cloud-delivered security is uniquely difficult to benchmark, and what a meaningful evaluation looks like for distributed architectures.*   *TEST4NET LLC is an independent network and security testing laboratory. We evaluate WAF, IPS, and DLP platforms using methodology designed to reflect production conditions, not vendor-optimized test scenarios. Contact us.*   Share Pass it on to someone who runs a network Independent lab data is most useful in the hands of the people who make the call. Send this piece to a colleague. [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ftest4net.com%2Fblog%2Fwaf-ips-dlp-content-inspection-testing) [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Ftest4net.com%2Fblog%2Fwaf-ips-dlp-content-inspection-testing&text=WAF%2C+IPS%2C+and+DLP%3A+Why+Content+Inspection+Testing+Is+Harder+Than+It+Looks) [Telegram](https://t.me/share/url?url=https%3A%2F%2Ftest4net.com%2Fblog%2Fwaf-ips-dlp-content-inspection-testing&text=WAF%2C+IPS%2C+and+DLP%3A+Why+Content+Inspection+Testing+Is+Harder+Than+It+Looks) [WhatsApp](https://wa.me/?text=WAF%2C+IPS%2C+and+DLP%3A+Why+Content+Inspection+Testing+Is+Harder+Than+It+Looks%20https%3A%2F%2Ftest4net.com%2Fblog%2Fwaf-ips-dlp-content-inspection-testing) Copy link More apps ![](https://test4net.com/hubfs/IMG_0070.jpg) Written by ### [Alexander Zemskov](https://test4net.com/blog/author/az) Alexander Zemskov leads network and security testing at TEST4NET, an independent, vendor-neutral testing lab in Yerevan, Armenia. With 19+ years in performance and load testing on IXIA, Spirent, Keysight, Xena and Xinertel platforms, he runs NGFW, WAF, IPS, DLP and SASE evaluations for telecom operators, banks and system integrators. [LinkedIn](https://www.linkedin.com/in/azemskov/) [Website](https://test4net.com/?hsLang=en) [Previous article NGFW Testing: Fast Paths, Fake AppMix, and PCAP Replay Traps](https://test4net.com/blog/ngfw-testing-fast-path-appmix-pcap?hsLang=en) [Next article SASE: Why Vendor Cloud-Security Benchmarks Miss Your Real Deployment](https://test4net.com/blog/sase-benchmark-evaluation-methodology?hsLang=en) ### Comments In this article Put it to the test ### Have a device to put through this? Send us the shortlist and the KPIs that decide it. We will come back with a scoped test plan, a timeline and a fixed price. [Talk to a test engineer](https://test4net.com/contacts?hsLang=en) Blog ## Keep reading [News](https://test4net.com/blog/tag/news) ### [Calnex: the clock nobody checks, and the 5-hour outage that proves it](https://test4net.com/blog/calnex-the-clock-nobody-checks-and-the-5-hour-outage-that-proves-it?hsLang=en) Calnex published a piece on timing resilience by Stefano Ruffini, rapporteur of ITU-T SG15 Q13 (Calnex blog, 19 August 2026). The thesis is short: networks encrypt traffi… ![](https://test4net.com/hubfs/IMG_0070.jpg) Alexander Zemskov · Sep 8, 2026 · 2 min read [News](https://test4net.com/blog/tag/news) ### [Keysight: flowlet balancing evens out AI fabric traffic where ECMP piles it up](https://test4net.com/blog/keysight-flowlet-ai-ecmp?hsLang=en) Keysight published a short lab study on load balancing in AI data-center fabrics (Eric Yu, Keysight blog, 27 May 2026). Short version: the traffic of a training job break… ![](https://test4net.com/hubfs/IMG_0070.jpg) Alexander Zemskov · Sep 8, 2026 · 2 min read [![Wi-Fi testbed diagram: controller, access point under test on a turntable in an RF chamber, emulated client chamber and second AP chamber connected through programmable attenuators](https://test4net.com/hubfs/blog-covers/wifi-testing-cover-2.png)](https://test4net.com/blog/wi-fi-testing-for-high-performance-use-cases-why-a-walk-test-is-not-a-test?hsLang=en) ### [Wi-Fi Testing for High-Performance Use Cases: Why a Walk Test Is Not a Test](https://test4net.com/blog/wi-fi-testing-for-high-performance-use-cases-why-a-walk-test-is-not-a-test?hsLang=en) Wi-Fi used to be the network you tolerated. Now it carries the video call with the customer, the telehealth session, the factory floor and the classroom. This post is abo… ![](https://test4net.com/hubfs/IMG_0070.jpg) Alexander Zemskov · Sep 8, 2026 · 15 min read [![TEST4NET LLC](https://test4net.com/hubfs/test4net-logo-fixed.svg)](https://test4net.com?hsLang=en) Independent testing and validation for telecom, information security and cloud infrastructure — real insights, not assumptions. [mailto:sales@test4net.com](mailto:sales@test4net.com) #### Navigate - [Home](https://test4net.com/?hsLang=en) - [Why TEST4NET](https://test4net.com/why-test4net?hsLang=en) - [About us](https://test4net.com/about?hsLang=en) - [Contact](https://test4net.com/contacts?hsLang=en) - [Blog](https://test4net.com/blog?hsLang=en) - [Industry News](https://test4net.com/news?hsLang=en) #### Get in touch Sales [sales@test4net.com](mailto:sales@test4net.com) Support [support.test4net.com](https://support.test4net.com) © 2026 TEST4NET LLC. All rights reserved. [Privacy Policy](https://test4net.com/privacy-policy?hsLang=en) [Legal](https://test4net.com/legal?hsLang=en) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Alexander Zemskov", "url" : "https://test4net.com/blog/author/az" }, "dateModified" : "2026-09-06T20:10:30.808Z", "datePublished" : "2026-07-10T16:38:58.000Z", "headline" : "WAF, IPS, and DLP: Why Content Inspection Testing Is Harder Than It Looks", "image" : [ "https://test4net.com/hubfs/AI-Generated%20Media/Images/Layered%20Document%20Inspection%20with%20Scanning%20Lines%20and%20Amber%20Highlights.png" ], "mainEntityOfPage" : { "@id" : "https://test4net.com/blog/waf-ips-dlp-content-inspection-testing", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://test4net.com/hubfs/test4net-logo-fixed.svg" }, "name" : "TEST4NET LLC" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://test4net.com/#organization", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "AM", "addressLocality" : "Yerevan", "postalCode" : "0033", "streetAddress" : "3 Hakob Hakobyan Street (Mergelyan Hub)" }, "alternateName" : "TEST4NET", "contactPoint" : { "@type" : "ContactPoint", "availableLanguage" : [ "en", "ru", "hy" ], "contactType" : "sales", "email" : "sales@test4net.com", "telephone" : "+374-60-88-88-99" }, "description" : "Independent, vendor-neutral lab for testing network and cybersecurity products — NGFW, WAF, IPS, DLP and SASE — and an authorized distributor of test, measurement and network infrastructure solutions.", "email" : "sales@test4net.com", "foundingDate" : "2024", "image" : "https://test4net.com/hubfs/og-t4n.png", "logo" : "https://test4net.com/hubfs/test4net-logo-fixed-2.svg", "name" : "TEST4NET LLC", "sameAs" : [ "https://www.linkedin.com/company/test4net/", "https://t.me/TEST4NET", "https://www.facebook.com/people/Test4net-LLC/61591470856077/" ], "telephone" : "+374-60-88-88-99", "url" : "https://test4net.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://test4net.com/#website", "@type" : "WebSite", "inLanguage" : "en", "name" : "TEST4NET", "potentialAction" : { "@type" : "SearchAction", "query-input" : "required name=search_term_string", "target" : { "@type" : "EntryPoint", "urlTemplate" : "https://test4net.com/hs-search-results?term={search_term_string}" } }, "publisher" : { "@id" : "https://test4net.com/#organization" }, "url" : "https://test4net.com/" } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://test4net.com/", "name" : "TEST4NET", "position" : 1 }, { "@type" : "ListItem", "item" : "https://test4net.com/blog", "name" : "Blog", "position" : 2 }, { "@type" : "ListItem", "item" : "https://test4net.com/blog/waf-ips-dlp-content-inspection-testing", "name" : "WAF, IPS, and DLP: Why Content Inspection Testing Is Harder Than It Looks", "position" : 3 } ] } ```