Imperva: Web Application Firewall (WAF) Review

Imperva Web Application Firewall (WAF) secures active and legacy applications, third-party applications, APIs, microservices, cloud applications, and VMs. 

Imperva, founded in 2002, is headquartered in San Mateo, California. The company has grown to employ over 1,000 people, offering services to over 6,200 customers in 150 countries.

Imperva and the WAF Market

The WAF market is heavily saturated, with a considerable number of competitors, leaving Imperva with 0.61% of the web and mobile application security market share. AWS’ WAF leads their competitors with 2.66% of the market share, while Barracuda WAF trails at 0.33%, and Fortinet FortiWeb has 0.15%.

Features

• Dynamic Profiling eliminates the need for tedious manual configuration by automating the process of profiling applications to create a baseline of acceptable user behavior
• Actively protect web applications from attack with virtual patching
• Graphical reporting provides details regarding security posture and compliance (PCI, SOX, HIPAA, and FISMA)
• Identify and quarantine backdoors planted on your sites
• Accessing the dashboard using a standard browser or a mobile app provides access to real-time traffic monitoring and event analysis
• Review website traffic for vulnerabilities, such as SQL injection, cross-site scripting, remote file inclusion, site scraping, and comment spam
• Protect against OWASP Top Ten security attacks
• Identify and prevent multi-stage attacks by correlating ongoing security violations looking for established patterns

Benefits

• Flexible deployment options: physical appliance, virtual appliance, or in the cloud
• Robust library of APIs over DevOps integration options including support for leading SIEMs
• Provides always-on protection, profiling incoming traffic in real time using their advanced identification engine

Use Cases

This confidence brought TicketNetwork to Imperva.

Faced with the challenge of securing transactions for sellers and buyers of over sevem million event tickets every day, TicketNetwork deployed Imperva’s WAF. 

When their existing solution could no longer keep up with high traffic loads, TicketNetwork knew they needed to find a new product that was designed to scale. Also important was ease of use, fast deployment, and a commitment to quick compliance as new threats emerge. 

Delighted by a deployment that was completed in less than a week, TicketNetwork feels confident with their speed to security and compliance. With the addition of Imperva’s ThreatRadar add on service, TicketNetwork saw an immediate reduction in the traffic from malicious sources that comprises 25% of their site visits. 

With all their traffic flowing through Imperva, TicketNetwork has been able to focus their security team on other priorities. 

Differentiators

In addition to their WAF, Imperva offers a valuable suite of additional protection options for applications, APIs, and microservices.

• Runtime application self-protection (RASP): Real-time attack detection and prevention
• API security: Ensure API endpoints are protected and shielded from exploitation
• Advanced bot protection: Protect website, mobile app, and API access points from business logic attacks
• DDoS protection: Ensure business continuity and guarantee uptime
• Attack analytics: Machine learning and domain expertise provide the data necessary to detect, isolate, and prevent attack campaigns
• Client-side protection: Identify dangerous JavaScript services capable of client-side attacks  

User reviews of Imperva

Imperva WAF enjoys consistently positive reviews across many trusted sources, with users confirming their satisfaction and likelihood to recommend the product to their peers.

Gartner Peer Insights: 4.7 out of 5

PeerSpot: 4.4 out of 5

G2: 5 out of 5

TrustRadius: 9.4 out of 10

Pricing

Imperva Cloud WAF pricing begins at $59 each month per site for their Professional Plan, with a jump to $299 each month per site for their Business Plan. 

Enterprise-level solutions with on-premises appliances are also available, starting between $6,000-$10,000, but pricing will depend on each organization’s requirements.  

Imperva is so confident that you will love their WAF, they also offer a 30-day free trial.

Conclusions

Organizations are responsible for protecting their web applications from existing and emerging security threats. Imperva WAF is a simple and solid choice as an out-of-the box, drop-in solution to secure web assets and prevent costly data breaches.