Don't just look for a "solution" like a WAF or a one-time scan for PCI DSS but rather a set of controls and reasonable processes that help meet your business's overall information security goals. The following two articles I wrote may help clarify this for you: The realities of PCI DSS 6.6 application code reviews