If you manage Linux systems in production, you already operate with multiple layers in place. Network firewalls, SELinux or AppArmor, IDS and IPS, and regular patching. From the operating system's perspective, the environment is controlled. Still, web applications running on top of that stack continue to be the source of incidents, audit findings, and late-night investigations. Not because the OS failed, but because most modern attacks never need to touch it.

Source: Web Application Firewall Overview: Enhancing Linux Security