CloudGuard WAF

My main use case for Check Point CloudGuard WAF  is to protect web applications from external attacks, and I am primarily using it to monitor and filter HTTP/HTTPS traffic, block malicious requests, and protect applications from common threats such as attacks, malicious SQL injection, cross-site scripting, and bot attacks.

For example, in a web application protection scenario, we place our web application behind Check Point CloudGuard WAF , which inspects all HTTP and HTTPS traffic before it reaches the application server, and we enable automatic protection for OWASP Top 10 attacks such as SQL injection.

The best feature of Check Point CloudGuard WAF , in my experience, is the AI-based threat detection, specifically the AI-driven security engine that analyzes HTTP/HTTPS traffic and detects malicious patterns automatically, allowing it to block attacks and even unknown zero-day attacks without relying only on a signature base.

The AI-driven analysis of Check Point CloudGuard WAF  helps me detect attacks that traditional signature-based systems might miss by analyzing the behavior and structure of the HTTP/HTTPS request and learning the normal behavior of the web application. It builds a baseline of normal traffic patterns, such as valid URL parameters, request types, and user behavior, and flags unusual requests as potential attacks.

The AI-driven analysis reduces normal rule creation and lowers false positives by learning application behavior while providing automatic protection updates without constant tuning.

In our organization, Check Point CloudGuard WAF has had a very positive impact on web application security and operational efficiency, significantly improving protection against web-based attacks with AI-driven protection and automatic learning, resulting in better visibility and monitoring through the dashboard and logs to quickly identify attack attempts.

In my experience, Check Point CloudGuard WAF is a strong solution but could be improved in a few areas, such as simplifying and customizing the user interface and reporting dashboard, making integration with third-party SIEM  or monitoring tools easier for quick correlation of WAF events, and making policy tuning and configuration more straightforward for new users.

I have been using Check Point CloudGuard WAF for around one year, during which I have been tasked with the initial deployment, policy configuration, monitoring web traffic, and protecting web applications from common attacks such as OWASP Top 10 vulnerabilities.

Check Point CloudGuard WAF is stable and working properly.

Check Point CloudGuard WAF is built on the modern cloud and hybrid infrastructure, allowing it to scale across multiple public clouds.

Customer support for Check Point CloudGuard WAF is good since they provide same-day responses for critical cases and sometimes even respond within one hour for high-priority cases, with a response time of five to six hours for others.

Check Point CloudGuard WAF has helped me save time by reducing my workload, although I cannot quantify the exact return on investment.

After deploying Check Point CloudGuard WAF, we observed several measurable improvements, including a significant reduction in incidents because the WAF blocks malicious traffic such as SQL injection, as well as improved incident detection and response time and a reduction in false positives, all of which help strengthen application security and improve operational efficiency for the security team.

I am using the WAF alongside Check Point Quantum Security Gateway , although it is not integrated with the WAF. I am only using the WAF for my application side.

In my experience, Check Point CloudGuard WAF is very effective at preemptively blocking zero-day attacks and detecting hidden anomalies, unlike traditional WAFs that rely mostly on signature-based detection, as it utilizes AI-driven behavior analysis and contextual learning.

Check Point CloudGuard WAF has helped reduce my false positives.

In my experience, Check Point CloudGuard WAF provides significant efficiency improvements compared to traditional WAF solutions, which rely on static signature-based rules, whereas CloudGuard learns the normal behavior of the application, detects suspicious patterns, and blocks attacks without constant manual rule creation.

My advice for organizations considering Check Point CloudGuard WAF is to clearly understand their application architecture and traffic patterns before deployment to help the WAF learn normal application behavior faster and reduce false positives and to consider starting with monitoring mode. I would rate this solution a 9 out of 10.

I use Check Point CloudGuard WAF  for CSPM and posture management. In some places, I use native app protection-related management, and in other places, I use it for runtime protection. These are all some of the use cases I have utilized it for. I also use it for CASB  in some locations, compliance assessment, adaptive access control, UEBA , policy enforcement, and threat protection. I have performed all of these functions using firewalls.

Traditional WAF  with Check Point CloudGuard WAF  has some features that could be integrated inside the WAF  that might be helpful. I normally use a separate tool for API security, and I used to perform OWASP top 10 or 20 assessments. Not everything falls under WAF.

However, if it is included, especially in today's market where AI-related features are all integrated, that would be tremendously helpful. AI and modern viruses such as token theft, tool poisoning, command injection, unauthorized access, and prompt injection are all concerns. If you have prompt injection detection in Check Point CloudGuard WAF, that would be the greatest help for the market. I would give you one more thing called a rug pull attack. Prompt injection is critical to address. Today everything is prompt-based and AI-based, and there will definitely be some bots. Those bots will definitely cross this WAF. There are some modern AI-based vulnerabilities such as token theft and tool poisoning. Tool poisoning means that some malicious command will be hidden inside, and then passwords will be saved insecurely. This happens everywhere, sometimes by mistake or unintentionally, but these mistakes are what allow hackers to penetrate. Token  theft, tool poisoning, token passthrough, command injection, rug pull attack, unauthenticated access, and prompt injection are all seven major problems for people like me, CISOs.

I have worked as a customer, partner, solutioner, and implementer. I have been with Check Point since Check Point NG's time. Check Point launched the new generation around 2000 if I understood correctly, and I have been with Check Point since then.

These kinds of Israeli products are strong, clever, and powerful tools. They are all strong, clever, and powerful tools compared with American products, to be honest and upfront. Palo Alto has beaten Check Point in the recent past by bringing these creamy layers of Israeli companies into their organization, if I understood correctly.

I am a CCSE by the way. Check Point Certified CCSE. I have been holding this certification for quite some time. In short, Check Point CloudGuard WAF is a powerful tool. In short, its look and feel is also not something everyone will like. People like me, a rare breed, will like Check Point CloudGuard WAF. Not everyone, to be honest.

There are some scoring companies I have worked with that focus on security scoring, risk scoring, and prioritization. These are all very good in Check Point CloudGuard WAF, I would say. Advanced threat detection is also fine. Check Point CloudGuard WAF also provides threat intelligence for us, which includes actionable information about current and emerging security threats. Check Point CloudGuard WAF produces all kinds of reports that involve collecting, analyzing, and sharing data about threat actors and their TTPs and IOCs. It is also strategic, tactical, technical, and operational. I like their threat intelligence products. It is strategic, tactical, technical, and operational.

There are some API gateway and API securities I mentioned. If these are incorporated with AI-related features, particularly those seven key vulnerabilities I mentioned—token theft and tool poisoning—that would be beneficial. AI-related features are not included yet in Check Point CloudGuard WAF. However, they are present in FortiGate. That is the advantage of FortiGate now. FortiGate is stopping all AI-related vulnerabilities now. FortiGate has this capability. It is unfortunate that even Palo Alto also lacks one or two of these features.

Check Point Quantum is very good, without a doubt. However, their capabilities are not in comparison with Palo Alto. There are some features, but there are some gaps in comparison with Palo Alto.

I have been using this solution for a few months only.

I have not encountered glitches. There is something called implicit deny. Until I face any issues on the network as a CISO, such as issues due to the firewall being down or glitches, or if any vulnerabilities penetrated in, then I would be worried. However, by default, Check Point CloudGuard WAF will not be configured in that way.

Based on what the customer is requesting, if the customer wants some third-party integration, such as Wazuh , which is a SIEM  tool, or they want to deploy with some open source product, then complexity comes in. However, if we are only installing Check Point CloudGuard WAF, the deployment is very nice and very cool. Check Point CloudGuard WAF has very nice videos, deployment documents, and deployment guides available. I have seen it, run it, and installed it in various operating systems and appliances, as well as virtual appliances in the cloud.

I have seen ROI. However, when I am not worrying about the cost, I am also not worrying about the ROI. Selling a product is not my job. I am a CISO for a service organization. If you want, I will create the solution. When someone is requesting a solution, if that someone is also requesting ROI information, then I will give all of those metrics. However, it is a rare case that they will request ROIs, because I am not going to worry about the cost of the product. I am worrying about the features and vulnerabilities. Reduction of vulnerabilities is important. I hope you understand.

Check Point CloudGuard WAF is expensive. It is a little bit expensive. You cannot avoid this from an Israeli product. Israeli products follow a certain pricing model. If they could reduce the cost a bit, then they can compete with Palo Alto. Palo Alto is leading, Cisco is down, and Palo Alto is coming up. There is something peculiar in the market. Cisco for the last three or four quarters has been very down. In fact, last year they made very less profits. However, Palo Alto was somewhere in the cloud. Check Point CloudGuard WAF is also coming up, but not the Palo Alto.

We do not care about alternate solutions. We never care about the cost. There is something called pair-wise comparison. I am a CISO, by the way. When any of the clients are in a process of deploying a firewall or global firewall for their organization, they will come to me and request, "CISO Krishna, why can't you give me the top three or four firewalls in the market?" I normally say the first one is Palo Alto, FortiGate, and then Check Point Quantum. These are the three top firewalls I usually recommend. I have a readymade PowerPoint deck in comparison, a pair-wise comparison with these three. In that comparison, there is the cost of each one and everything.

Cost is normally something I do not worry about. I will explain to the client, and it is their responsibility. Finally, they will choose the cheap one. Many people are going with FortiGate. And some people come to Check Point CloudGuard WAF. Rare people go for Palo Alto, or someone is really worried about their security, like banking organizations or financial institutes, those people go for Palo Alto.

I will not give any total cost of ownership about the product. I will give the features for this cost. I will explain the advantages, disadvantages, pros, and cons of each product, and then I will present it to the customer. It is up to the customer who will select the product, and we will also recommend. Sometimes we recommend Palo Alto, sometimes we recommend Check Point CloudGuard WAF, sometimes FortiGate, and sometimes other firewalls. In many places, we will not recommend. We will give it as it is. That is called pair-wise comparison. We will compare it and give it to the client, and it is the client's responsibility to choose their own product.

I also use Orca  and Palo Alto. With the four products — true positive, false positive, true negative, false negative — these are problems everywhere. That is the reason I recommend this tier-one firewall companies to the client. Out of ten, maybe one or two might be false positives.