A web administrator has added content to a web application, but users are unable to access the new content. What could be preventing them from accessing the content?

Negative security blocks known-bad traffic via attack signatures, and an invalid regular expression in a signature would not prevent users from accessing new, legitimate content.

A signatures or threat database is a component of negative security, not positive security - positive security blocks based on missing allowlist entries, not outdated threat feeds.

Positive security (allowlist model) denies all traffic by default and only permits resources that have been explicitly defined as allowed in the security policy. When a web administrator adds new content to the application, the WAF or security policy must also be updated to include that content as an allowed resource; until that update is made, all requests to the new content are blocked regardless of their legitimacy.

Denial of service signatures are a negative security mechanism and not updating them would not restrict access to newly added application content.