There are some great security technologies out there to act as a defensive layer in front of your application. However, if you want an efficient application security test, I would strongly suggest that you disable them for your tester unless you are looking for some really niche, edge-case bugs.