Why do WAF logs miss evidence of client-side data theft?

WAF logs only capture the initial delivery of third-party scripts to browsers, not what those scripts do afterward. When malicious JavaScript steals user data, the theft happens through direct browser-to-attacker communication that bypasses your infrastructure entirely. Your WAF logs might show that a script was successfully delivered, but they'll contain no evidence of the subsequent data collection, manipulation, or exfiltration that occurs on the client-side.