critical severity violations

We have just created our first web application asm security policy. The policy was setup by f5 admin which he considers it is suitable for the web application. My job is kind of auditing this policy, I have reviewed all the violations setup, all the violations that have critical severity are blocked, however some error and warning violations are not blocked nor alarm such as (illegal entry point). My big concern on this application that it has sensitive data. Violations that causes buffer overflow are not important to us as the ones that cause stealing information. The question now are violations that have critical severity enough to protect the web application?

I appreciate your reply.