AWS WAF vs. Arcjet

AWS WAF (Web Application Firewall) is a security service designed to protect web applications and APIs from common web exploits and bots that can compromise security, affect availability, or consume excessive resources. By enabling users to define customizable web security rules, AWS WAF allows precise control over which traffic to allow or block, ensuring robust protection tailored to specific application needs.

Arcjet is runtime security for AI agents. It puts the decision where the action is: block prompt injection, stop PII leaks, block bots, and add guardrails to tools, APIs, and database calls. Identity tells you who is asking, but it cannot tell you what happens next. Arcjet runs inside the code that takes the action, so every agent action is observed in the run it belongs to, checked before it executes, and kept as evidence afterwards. Each check returns a decision your code acts on: allow, block, redact, or hold for review.