cloud security costs

How do you keep bot traffic from running up WAF costs on a public API?

I'm looking at the cost of filtering automated traffic before it reaches a public API. Per-request WAF charges seem hard to control when bots keep hitting the endpoints.…