We've got firewalls, antivirus, a WAF but still losing money to attacks no tool sees
I run a small online retail business. Over the past few months we've had multiple incidents where orders were placed at tampered prices, or refunds were issued to accounts that shouldn't get them. Our payment processor says the requests look completely normal. Our WAF, firewall, antivirus none of them flagged a thing. It's like someone is exploiting the logic of our website from the inside, using features exactly as they're designed but twisting them. I'm not a security expert, just a business owner trying to stop the bleeding. Is there any type of protection that can actually see what our web application is doing when it handles a request, and stop this kind of abuse in real time? Everything we have is focused on network traffic or endpoint scans, but the attacks seem to happen deeper, inside the app itself. Any advice would be a lifesaver.