Sold by: Check Point Software Technologies
CloudGuard Code Security is a blazing-fast language-agnostic scanner for detecting secrets, CVEs, and compliance violations in code and IaC with CI/CD hardening features, which seamlessly integrates into everything from the IDE to git and build machine.
4.4
Overview
Check Point CloudGuard Code Security is a powerful language-agnostic code scanner able to: Detect hardcoded secrets, keys, and credentials in any programming language with dynamic detectors in repos and host file systems.
Detect and remove secrets from Jira and Confluence.
Identify compliance violations against industry standards and regulatory requirements, including various AWS frameworks for Infrastructure as Code (IaC) template configurations.
Seamlessly integrate with VS Code, GitHub, GitLab, and Bitbucket, as well as CI/CD tools like Jenkins, CircleCI, AWS CodePipeline, and many more, with pre-receive hooks for blocking risky commits to periodic repo scans using git bots.
No reliance on cloud services, meaning your source code never leaves your environment.
Harden CI/CD pipelines and limit source code access to mitigate code exfiltration risks and unauthorized access. Designed for developers but built for the CISO organization, CloudGuard Code Security is a DevSecOps/Shift-Left solution that ensures code security does not hinder development speed or burden developers with building intricate scanner rules and quality gates while empowering security practitioners with full visibility and control over rules and posture. It achieves this with: Blazing fast scan speed: approximately 10 MB in half a second.
Detailed remediation playbooks, providing developers with solutions rather than problems.
Dashboards designed to facilitate cooperation between developers and security practitioners from the VP R&D/CISO level down to the software engineer/SOC expert.
2,800 out-of-the-box detectors, allowing security experts to enforce rules without requiring coding/DevOps skills. From identifying risky code (e.g., open ports, dated protocols, etc.) to detecting hard-coded keys and credentials and IaC violations of security farmwork, nothing escapes our detectors.
Seamless integration with Check Point CloudGuard ecosystem, extending code security to runtime (including secrets, malware, and CVE detection in containers, VMs, and serverless).
Highlights
- No More Secrets: Regardless of programming language. Detect secrets like API keys and passwords in any programming language spanning your entire development pipeline from the IDE to the build machine, as well as Jira and Confluence.
- Blazing Fast Performance: 10 MB of code in half a second. Scan 10 MB of code in about half a second with over 2800 active detectors out of the box, providing high-speed security without disrupting development workflows and without sending your code for scanning in the cloud.
- Compliance Enforcement: From ISO, to NIST, CIS, PCI, and more. Identify compliance with various AWS frameworks for Infrastructure as Code (IaC) template configurations, ensuring your cloud infrastructure meets industry standards and best practices before configurations reach your cloud.
Details
Delivery method
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Custom pricing options
Pricing is based on your specific requirements and eligibility. Request a private offer to receive a custom quote. Sign in to view any offers that have been extended to you.
Legal
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Support
Vendor support
CloudGuard Code Security Support Information
This offer includes Premium Support. For the full list of included support services visit: https://www.checkpoint.com/support-services/support-plans/
- To open a support ticket, please have your Check Point user center account information available. If you do not have a user center account, sign up for one here: https://accounts.checkpoint.com . Need support? Contact us at
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Advanced threat prevention security for AWS and hybrid cloud environments, with Threat Extraction and Threat Emulation, and a built-in security management server
Check Point Check Point Cloud Firewall is a cloud-native security gateway that delivers automated, advanced threat prevention and multi-layered network security for assets that customers migrate to or store on AWS. Try it free for 30 days.
A single pane-of-glass security management console delivers consistent visibility, policy management, logging, reporting and control across all cloud environments and networks
Advanced threat prevention security for AWS and hybrid cloud environments, with Threat Extraction and Threat Emulation, and with GWLB (starting with R81.20)
**Please note: To ensure optimal operations, Check Point recommends a 4 vCores machine size. This provides balanced efficiency and smooth performance, which most customers find ideal for their needs.
Customer reviews
KAUSHILAMBATKAR
Advanced protection has secured APIs and simplified centralized network defense
Reviewed on Sep 07, 2026
Review provided by PeerSpot
What is our primary use case?
I have been working with Check Point WAF (formerly CloudGuard WAF) for 14 years.
Check Point WAF (formerly CloudGuard WAF) is particularly useful for protecting my network from external attacks, such as DDoS attacks and broken authentication.
Regarding which product of Check Point I would like feedback about, I chose Check Point WAF (formerly CloudGuard WAF) solution.
What is most valuable?
What I appreciate about Check Point WAF (formerly CloudGuard WAF) is that it has an auto-enabled CDN within it, which helps us because even if there are floodgates created by an attacker, the CDN gets enabled automatically, and the UI is well organized, so even if a graduate comes in and tries to explore it, they are able to do so.
Moreover, network segmentation can be done very easily using WAF.
The key benefits I have seen from using Check Point WAF (formerly CloudGuard WAF) is that it can be centrally managed, so if we have ten firewalls, they can be centrally managed through one center and one platform, which is one of the key features I appreciated.
Check Point WAF (formerly CloudGuard WAF) has improved my ability to discover, monitor, and protect APIs so that our security risk, which was ambient earlier, is now green, and the security posture assessment by third-party evaluators shows we are green.
What needs improvement?
Regarding the false positive rate, we need to configure it according to our environment because unless we configure it according to our environment, it's a tedious process, particularly with Check Point WAF (formerly CloudGuard WAF), and sometimes if it's not configured properly, there are more than 60% of false positives that we receive.
Apart from the configuration aspect, I would like to see improvements in false positives, and the second part is endpoint security because there is no agentless control. If endpoints can be managed using Check Point WAF (formerly CloudGuard WAF), that would be very beneficial, rather than it being just a firewall.
Check Point WAF (formerly CloudGuard WAF)'s AI-driven threat detection and prevention capabilities is one area wherein I believe Check Point lacks, as I did not find many AI features in Check Point, but compared to Palo Alto, they have better AI capabilities.
What do I think about the stability of the solution?
When it comes to stability and reliability, I find Check Point WAF (formerly CloudGuard WAF) stable.
We do have crashes, downtimes, and performance issues, but we receive good support from Check Point, so it is taken care of by the Check Point vendor.
What do I think about the scalability of the solution?
When it comes to scalability, I would rate it as nine out of ten, as it's very easy to scale, and whenever we bring in some VLANs or different networks, we can easily integrate them within Check Point WAF (formerly CloudGuard WAF).
How are customer service and support?
I would rate the technical support of Check Point as eight out of ten.
Which solution did I use previously and why did I switch?
Prior to adopting Check Point WAF (formerly CloudGuard WAF), I previously used a different solution called SentinelOne.
How was the initial setup?
Before implementing Check Point WAF (formerly CloudGuard WAF), I was trying to solve network security challenges, particularly all the challenges that exist for network security.
What about the implementation team?
I utilize Check Point WAF (formerly CloudGuard WAF) alongside Check Point Firewall, which is the basic firewall.
What was our ROI?
Since implementing Check Point WAF (formerly CloudGuard WAF), it has helped us to get more business, and along with that, we are able to prevent threats to our organization using Check Point WAF (formerly CloudGuard WAF).
What's my experience with pricing, setup cost, and licensing?
Apart from the pricing, other differences I found include that Check Point WAF (formerly CloudGuard WAF) is centralized, as ASA does not have centralized management, and although Palo Alto does, Check Point WAF (formerly CloudGuard WAF) is found to be more user-friendly.
Which other solutions did I evaluate?
The main reasons I selected Check Point WAF (formerly CloudGuard WAF) over other solutions were that it is a smarter firewall than others, and it was more cost-effective compared to Palo Alto, as they provided a lengthy quotation, and ASA is a legendary solution, but no one uses ASA nowadays.
What other advice do I have?
For assessing Check Point WAF (formerly CloudGuard WAF) for preemptively blocking zero-day attacks and detecting hidden anomalies, we particularly use CrowdStrike for that function, as we detect using CrowdStrike, and there is not much on Check Point WAF (formerly CloudGuard WAF)'s side.
For ZTNA, I can maintain a ZTNA using certain MFAs or enabling certain network controls, so on the ZTNA side, it performs well.
Regarding integration, how Check Point WAF (formerly CloudGuard WAF) and firewalls integrate with my existing systems, I find the integration with third parties straightforward as I have not encountered challenges, complexities, or needed to work on or enable anything there.
I do not find any challenges with the ongoing management of Check Point WAF (formerly CloudGuard WAF), so maintenance is very smooth, and I do not face any issues with that.
I purchased Check Point WAF (formerly CloudGuard WAF) through a vendor, not directly through Check Point Technologies.
Given my experience with Check Point WAF (formerly CloudGuard WAF) and other technologies, I recommend Check Point WAF (formerly CloudGuard WAF). I would recommend it primarily for its scalability, which is very easy to scale, and the integration capability, as we can integrate it easily with systems like Splunk or any other SIEM devices. My overall review rating for Check Point WAF (formerly CloudGuard WAF) is 8.5 out of 10.
Eslam Osama
AI-driven protection has secured our cloud APIs and reduced false positives for dynamic workloads
Reviewed on Aug 26, 2026
Review from a verified AWS customer
What is our primary use case?
My main use case for Check Point WAF (formerly CloudGuard WAF) is web application API protection in cloud-native, hybrid, and multi-cloud environments, where it provides automated AI-driven threat prevention, comprehensive API security, zero-day and OWASP Top 10 protection, as well as bot protection and DDoS mitigation.
As a scenario, I can describe a broken object level authorization attack where an enterprise is running a containerized microservice application deployed via Terraform or Docker. The front end communicates with the back-end service through a REST API, and user authentication is handled by a central identity and access management provider such as OAuth2. The attack vector involved an attacker logging in with valid, low-privilege user credentials, which led them to probe the application's back-end endpoint. After requesting their own authorized record, they deployed a script to iterate through other IDs to scrape sensitive data from other tenants. Since the API calls are perfectly formatted and authenticated, a legacy signature-based WAF would typically allow this traffic through. However, the mitigation flow includes automatic schema enforcement, behavioral baseline, IAM context awareness, and surgical blocking. By applying these techniques, we can shift from static rule maintenance to dynamic, context-aware analysis, which is where Check Point WAF (formerly CloudGuard WAF) applies.
What is most valuable?
The best feature Check Point WAF (formerly CloudGuard WAF) offers is API security.
The features that stand out to me within Check Point WAF (formerly CloudGuard WAF) include the contextual AI threat engine, which I find to be a very useful tool, as well as automated API discovery. Additionally, I appreciate the unified multi-cloud management that allows for the management of policies, logs, and analytics across hybrid and multi-cloud environments through a single control plane.
Check Point WAF (formerly CloudGuard WAF) has positively impacted my organization by reducing rule maintenance, leading to less or near-zero false positives, and enabling frictionless DevSecOps alignment. Regarding Check Point WAF (formerly CloudGuard WAF) AI capabilities, it possesses local logging control, PII reduction, log suppression, tenant isolation, and deterministic threat scoring. The granular rule-based access list and auditability are also crucial, as they allow for enforcing strict rule-based access control and maintaining immutable audit logs for all admin actions and support access requests.
Check Point WAF (formerly CloudGuard WAF) AI-driven threat detection and prevention capabilities have helped my organization by providing more precise detection and response. Check Point WAF (formerly CloudGuard WAF) has improved my ability to discover, monitor, and protect APIs by automatically mapping undocumented API endpoints, ingesting OpenAPI specifications, and enforcing strict schema validation to prevent parameter tampering and logic abuse. This is achieved through automated API discovery and protection. In terms of AI, it evaluates requests against learned behavioral baselines rather than static RegEx signatures, effectively stopping zero-day exploits while drastically minimizing false positives.
What needs improvement?
There should be more tutorials and documentation about the usage of Check Point WAF (formerly CloudGuard WAF) online so more users and tenants can use these security services daily, as it is not as well-documented as other tools, such as the F5 WAF.
For how long have I used the solution?
I have been using Check Point WAF (formerly CloudGuard WAF) for three years.
What do I think about the stability of the solution?
Check Point WAF (formerly CloudGuard WAF) is stable.
What do I think about the scalability of the solution?
Check Point WAF (formerly CloudGuard WAF) scalability is impressive as it prevents the bottleneck common in traditional centralized WAF appliances and ensures the security throughput grows proportionally alongside application workloads. I do not see any bottlenecks, as it scales through a stateless micro-agent architecture that decouples traffic handling from control plane management.
Which solution did I use previously and why did I switch?
I purchased Check Point WAF (formerly CloudGuard WAF) through the AWS Marketplace.
How was the initial setup?
The deployment and ongoing management of Check Point WAF (formerly CloudGuard WAF) were easy.
What was our ROI?
I have not seen a return on investment, as I still have the same number of employees and the same amount of effort and time in hours.
What's my experience with pricing, setup cost, and licensing?
My experience with pricing, setup cost, and licensing for Check Point WAF (formerly CloudGuard WAF) is that it is a bit expensive.
What other advice do I have?
Nothing would make Check Point WAF (formerly CloudGuard WAF) closer to a 10 for me since a 10 would mean preventing against all attacks, which is why it cannot receive that rating; nothing can prevent every attack.
I would advise others looking into using Check Point WAF (formerly CloudGuard WAF) to take an evaluation license and try it first to understand how it works, and then try it again to form a final opinion about whether they are going to purchase it. This way, they can see if it fits within their current setup. I would rate this product an 8 out of 10.
Which deployment model are you using for this solution?
Hybrid Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
reviewer2108088
Secure filtering and application control have protected web workloads and simplified deployment
Reviewed on Jul 29, 2026
Review provided by PeerSpot
What is our primary use case?
I have found features like Cisco ASA and Firepower most valuable. Secure Firewall is a secure firewall with features like WAF and web applications. We have web filtering applications, secure features, and application controls among other features.
What is most valuable?
I have found features like Cisco ASA and Firepower most valuable. Secure Firewall is a secure firewall with features like WAF and web applications. We have web filtering applications, secure features, and application controls among other features. I am not using Cisco SecureX with Secure Firewall.
What needs improvement?
Currently, I have no suggestions for Cisco Secure Firewall. I am not working on the next-generation firewall of Cisco. As I already mentioned, I have no suggestions regarding the features and improvements. I am not working on Cisco firewall currently.
For how long have I used the solution?
Overall, I have been working with Cisco Secure Firewall for almost three to four years.
How are customer service and support?
I would rate the technical support by Cisco a nine out of ten.
How was the initial setup?
I think the implementation is easy. GUI-based implementation for firewalls is straightforward. Although the command line is a very simple process, next-generation firewalls now come with GUI-based interfaces.
What's my experience with pricing, setup cost, and licensing?
In comparison to other vendors, the pricing is reasonable and affordable.
Which other solutions did I evaluate?
I am currently using some Cisco products. I am currently using some switches of Cisco. I am working on the ASA series. I stopped working with Cisco Firewall more than one to two years ago. I am currently dealing mostly with other Cisco products. I am not dealing with Cisco Secure Access or Cisco Duo. I am working with different product vendors such as Check Point and Fortinet. I am working with Check Point Web Application Firewalls and using bundles with them. I am using some features such as WAF and UTP bundles with application controls, web filtering, email filtering, and DNS filtering and controls that are implemented with UTP enterprise bundles and other WAF applications. I have been dealing with Check Point for three to four years on different products. I am using other platforms and testing some things for the networks. I am also using some other products with them.
What other advice do I have?
I did not have new features or functionalities that I have used recently in Secure Firewall. Check Point WAF is used in my company and my customers are using it. I have seen measurable business and security outcomes since implementation of Check Point WAF (formerly CloudGuard WAF). All vendors design firewalls with application filtering. As per current incident reporting, we implement and update our feature updates and security databases. These databases are updated regularly. Check Point WAF (formerly CloudGuard WAF) works fine for every product like Cisco, Check Point, Fortinet, and Palo Alto. I am currently not using Check Point WAF as a primary solution, just for a specific purpose. Check Point WAF (formerly CloudGuard WAF) is working fine and reports, detects, and stops attacks such as IPS and detection. I would rate Check Point WAF (formerly CloudGuard WAF) a nine out of ten. The existing features are working fine, but new day-to-day attacks and issues arise in the environment globally, dealing with attacks such as phishing and DDoS attacks daily. Check Point WAF (formerly CloudGuard WAF) could improve by addressing the new day-to-day attacks and issues that arise in the environment and globally dealing with attacks. I have been satisfied with pricing, technical support, and performance. I am a customer of Check Point. I have been working in this field for several years. My overall review rating for this product is ten.
Babu K
Application security has reduced incidents and now needs UI fixes and shared exception rules
Reviewed on Jul 22, 2026
Review provided by PeerSpot
What is our primary use case?
We have implemented Check Point WAF (formerly CloudGuard WAF) in our environment. We have been dealing with Check Point WAF (formerly CloudGuard WAF) for three months. We are using Check Point WAF (formerly CloudGuard WAF) for our company only.
Currently, we are handling only the L7 part with Check Point WAF (formerly CloudGuard WAF), and we are planning to expand to the APIs and rate-limiting capabilities. We are not handling the network part, as we are only taking care of the security part with Check Point WAF (formerly CloudGuard WAF).
We have a team of 15 people who handle Check Point WAF (formerly CloudGuard WAF) and other security aspects. We have only two administrators dedicated to Check Point WAF (formerly CloudGuard WAF).
What is most valuable?
We have seen measurable business and security outcomes since implementation. We have observed reduced incidents with Check Point WAF (formerly CloudGuard WAF).
Check Point WAF (formerly CloudGuard WAF) has helped us reduce our false positives rate. Compared to other WAF solutions, Check Point WAF (formerly CloudGuard WAF) is user-friendly and very visible. When we review incidents with Check Point WAF (formerly CloudGuard WAF), it is clearly visible where the block occurred and it shows us detailed overview of the incident. In other products, I am not able to get the exact reason for the block, so I can identify where the block happened, and it is very user-friendly for me to add the policy or explicit policy there.
What needs improvement?
I face issues with the UI part of Check Point WAF (formerly CloudGuard WAF), as it malfunctions sometimes. Sometimes I do not see the icons in Check Point WAF (formerly CloudGuard WAF), and whenever I refresh the page, the icons remain invisible.
Additional features I have considered with Check Point WAF (formerly CloudGuard WAF) include the ability to add an exception rule. Since we have multiple projects, I want to add an exception rule to all projects as a shared exception, but when adding it, I am unable to add it individually.
For how long have I used the solution?
I have been working in this field for three years.
How are customer service and support?
When I raise any TAC ticket for Check Point WAF (formerly CloudGuard WAF), I am satisfied with their points and their support, as I am receiving immediate responses from the TAC. I can easily rate their support for Check Point WAF (formerly CloudGuard WAF) an eight out of ten.
An incident occurred regarding the Global Accelerator movement from CloudFront to Global Accelerator, and for that, it took one week to respond, which was delayed by five days.
Which solution did I use previously and why did I switch?
We considered the F5 WAF, Edge, and Radware before finally choosing Check Point WAF (formerly CloudGuard WAF).
How was the initial setup?
Compared to others, it was very easy for us to onboard Check Point WAF (formerly CloudGuard WAF) application.
What about the implementation team?
We received nice support from the OEM for Check Point WAF (formerly CloudGuard WAF), so they guided us, and we completed it within a week, onboarding one full project.
What other advice do I have?
The main reason why I chose Check Point WAF (formerly CloudGuard WAF) is about the cost, and we have a Check Point firewall and we also use endpoint security and email security, so we wanted to choose this as a one-stop solution.
I do not have an idea regarding Check Point WAF (formerly CloudGuard WAF)'s ability for preemptively blocking zero-day attacks and detecting hidden anomalies, as it has been only three months, so we are yet to explore things in Check Point WAF (formerly CloudGuard WAF). Currently, we did not check the AI-driven threat detection and prevention capabilities in Check Point WAF (formerly CloudGuard WAF). Are you referring to the Gen AI or the built-in part of the WAF?
Regarding the built-in AI-driven threat detection and prevention capabilities, I do not see any false positive detection based on the AI part in Check Point WAF (formerly CloudGuard WAF), so everything we are receiving is accurate results only. Based on that learning part, when Check Point WAF (formerly CloudGuard WAF) is in learning mode, the learning part is very helpful for us to filter those things, so after moving it to blocking, we are not receiving any false positive alerts or incidents. If I want to add an exception in Check Point WAF (formerly CloudGuard WAF), I can either add it in the shared one or in a local one.
I have given this review an overall rating of 7.5 out of 10.
Nagendra-Nekkala
Ai-driven cloud security has strengthened threat prevention and improved security posture
Reviewed on Jul 13, 2026
Review provided by PeerSpot
What is our primary use case?
The main purpose is to have network security through machine learning, which can offer threat detection and intelligence for my endpoints, and I am looking for application security.
I am looking for an AI-based solution that can strengthen my cloud-native security, automate security, and better prevent threats.
I am looking for an AI-based solution and unified cloud-native security from the SaaS platform to improve my security posture.
What is most valuable?
Check Point WAF (formerly CloudGuard WAF) is a SaaS platform that gives unified cloud-native security across my applications, workloads, and network, allowing me to automate security, prevent threats, ensure compliance, and manage my security posture well across all my cloud environments.
It conducts security scoring and risk scoring, which helps prioritize my security needs, and the advanced threat detection is also very fine, providing actionable information for my current security threats by collecting and analyzing data through threat actors and IOCs, offering tactical, technical, and operational features.
What needs improvement?
The false positive rate is a concern, but I could recommend improvements where false positives have to be minimized better.
This all depends on how the rules are customized and configured, and it can also improve with planning during the initial configuration, including threat intelligence and APIs, so it could enhance how it defends against attacks and prompts injections.
It can find the threat actors behind it, and I find that strategically and technically it is effective, although the AI-related features could improve, especially as global AI capabilities evolve, which are advancing more than what Check Point WAF (formerly CloudGuard WAF) provides compared to competitors.
There are no glitches; I believe improvement could be made primarily in API Gateway and API security, especially by enabling enhanced AI-related features for better fine-tuning.
For how long have I used the solution?
I have experience of two years with the product.
What do I think about the stability of the solution?
It is stable.
What do I think about the scalability of the solution?
It is definitely a highly scalable solution without any doubt.
How are customer service and support?
The customer support is very good.
Which solution did I use previously and why did I switch?
Earlier, we had Microsoft Defender, which we replaced with Check Point WAF (formerly CloudGuard WAF), and we are now ensuring that policy enforcement and threat protection are better.
How was the initial setup?
The deployment and initial setup are really straightforward; they provide enough documentation, videos, and deployment documents that are really helpful to complete it faster.
What was our ROI?
The return on investment is very good as it has increased my security posture and the operational efficiency of my engineers.
What's my experience with pricing, setup cost, and licensing?
It is a little bit expensive, but the pricing model is acceptable, though a reduction would make it more competitive with leaders such as Palo Alto.
Which other solutions did I evaluate?
I purchased from a different source.
What other advice do I have?
The configurations are pretty easy, and it is plug-and-play, which gives me regular updates.
I would assess the solution as positive in this regard.
All the integrations are pretty easy through API connectivity, which I can recommend more, and it also helps with modern AI-based vulnerabilities to conduct token tests and improve detection.
I would rate this review a 9 out of 10.