Sold by: Check Point Software Technologies
Deployed on AWS
Are you looking for an automated Web Application Firewall (WAF) with precise prevention and no management overheads? CloudGuard WAF delivers AI-enabled Web Application and API protection.
4.4
Overview
With deep application contextual analysis, CloudGuard WAF eliminates the tradeoff between the level of application security and the complexity of managing it. Your applications drive your business. As they evolve, grow, and expose more APIs, your attack surface expands. CloudGuard WAF learns how an application is typically used by profiling the user and the app content. It then scores each request accordingly, eliminating false positives while maintaining the highest security standards. CloudGuard WAF is easy to deploy and requires no ongoing maintenance as it continues to protect your evolving applications and APIs.
Advantages
- 90% of CloudGuard WAF customers run in prevent mode, demonstrating the hands-off nature of the management required
- 100% of CloudGuard WAF customers have less than 10 exception rules!
- CloudGuard WAF goes from deployment to active protection in just days, not weeks.
Click on the "View Usage Instructions" and "Usage Information" below to get next steps for setting up CloudGuard WAF.
This is a BYOL Image. Pricing and entitlements for this product are directly with Check Point. As an AWS partner Check Point enables marketplace transaction on this listing through a private offer provided by Check Point. Please contact your Check Point trusted advisers (link to a list of CP sellers / or directly to check point SDRs). Payment for the underlaying infrastructures are paid directly to AWS and is based on AWS pricing.
Highlights
- Precise Prevention: Contextual app analysis for high fidelity application security to prevent known and unknown cyberattacks.
- Automated by Design: Auto-deploy, hands-off management and AI-powered short learning cycles.
- Flexible deployment: Protect all applications in any cloud environment built on any architecture.
Details
Categories
Delivery method
Delivery option
Auto Scaling Group
Single Gateway into existing VPC
Single Gateway into new VPC
Latest version
Operating system
OtherLinux Gaia 3.10
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing and entitlements for this product are managed through an external billing relationship between you and the vendor. You activate the product by supplying a license purchased outside of AWS Marketplace, while AWS provides the infrastructure required to launch the product. AWS Subscriptions have no end date and may be canceled any time. However, the cancellation won't affect the status of the external license.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Vendor refund policy
Please see seller website for refund details.
Custom pricing options
Request a private offer to receive a custom quote.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Auto Scaling Group
A number of AppSec instances in an Auto Scaling Group. Load balanced by an ELB.
CloudFormation Template (CFT)
AWS CloudFormation templates are JSON or YAML-formatted text files that simplify provisioning and management on AWS. The templates describe the service or application architecture you want to deploy, and AWS CloudFormation uses those templates to provision and configure the required services (such as Amazon EC2 instances or Amazon RDS DB instances). The deployed application and associated resources are called a "stack."
Version release notes
Additional details
Usage instructions
Navigate to https://portal.checkpoint.com ; if you do not have an existing account, open a new account. Open the main menu (icon is in the top left corner), choose APPLICATION SECURITY under the CloudGuard column, then select Cloud on the left. The Getting Started page will open. After defining the asset, you will be redirected to the Profile page. Note: Obtain the Token for CloudGuard WAF from the Profile page.
Resources
Vendor resources
Support
Vendor support
To open a support ticket, send an email to infinity-next-support@checkpoint.com CloudGuard WAF
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Check Point CloudGuard WAF-as-a-Service (WAFaaS) is an AI-based WAF solution delivering the highest protection against known and zero-day threats through advanced AI and IPS signatures. CloudGuard WAFaaS provides multiple layers of protection: rate limiting, AI engines, IPS signatures, zero-day file security, bot protection. CloudGuard WAFaaS delivers a non-agent WAF, deployable within minutes, and adds advanced DDoS mitigation. Traffic is seamlessly routed through Check Point servers, which automatically issue SSL certificates.
Check Point CloudGuard WAFaaS is an AI-driven, fully managed web application firewall that provides advanced security for applications and APIs. It delivers real-time protection against zero-day threats, OWASP Top 10 vulnerabilities, DDoS attacks, and more, ensuring high availability, AWS security compliance, and uninterrupted service.
CloudGuard WAFaaS integrates seamlessly with AWS services, including Amazon Route 53, AWS WAF, AWS Shield, AWS API Gateway, Amazon CloudFront, and AWS Lambda, enabling automated threat prevention with minimal operational overhead.
Check Point CloudGuard WAF-as-a-Service (WAFaaS) is an AI-based WAF and API discovery and security solution, delivering the highest protection against known and zero-day threats using advanced AI & IPS. The CloudGuard WAF-as-a-Service provides multiple layers of protection: rate limiting, AI engines, IPS signatures, zero-day file security, bot protection, and comprehensive API discovery and schema validation. CloudGuard WAFaaS delivers a non-agent WAF, deployable within minutes, and adds advanced DDoS mitigation. Traffic is seamlessly routed through Check Point servers, which automatically issue SSL certificates.
- CloudGuard WAF
- CloudGuard CDR
- CloudGuard Network Security
- CloudGuard CNAPP
- CloudGuard Posture Management
- CloudGuard Code Security
- CloudGuard Workload
- Developer Security
Customer reviews
Maqsud A.
AI-Driven WAF with Minimal Manual Tuning
Reviewed on Feb 17, 2026
Review provided by G2
What do you like best about the product?
I like Check Point CloudGuard WAF because of its contextual AI that delivers near-zero false positives and automatic zero-day protection. I find it extremely valuable for providing strong automatic protection against zero-day threats with almost no false positives and requiring zero daily tuning effort.
What do you dislike about the product?
One area that could be improved is the initial learning period for very complex or highly dynamic applications, which sometimes requires a bit more manual exception tuning than I'd prefer in the first few weeks. Also, the initial setup/learning phase for complex apps can be a bit involved, and pricing feels premium, though the low-maintenance protection usually justifies it for serious environments.
What problems is the product solving and how is that benefiting you?
I expect Check Point CloudGuard WAF to solve zero-day attack exposure and reduce manual tuning and false positives. It offers strong, automatic protection with contextual AI, near-zero false positives, and minimal daily management, making it valuable for securing our cloud/web environments.
Md Akil A.
Effective Security with Easy-to-Use Interface
Reviewed on Feb 16, 2026
Review provided by G2
What do you like best about the product?
I like the Check Point CloudGuard WAF's GUI, which is very easy to use. It effectively helps in providing security to applications by allowing and blocking IPs, which is especially useful as we work on zero internet in our project. If we know an IP is part of our internal or external client, we can easily allow that IP. Check Point CloudGuard WAF's security is a key reason why we switched from using Azure Firewall.
What do you dislike about the product?
I think internal DNS needs to be removed. Also, the initial setup isn't easy, and when we try to resolve any ip it getting resolved but not from given source
What problems is the product solving and how is that benefiting you?
I use Check Point CloudGuard WAF to provide security to our application, allowing us to manage IPs by allowing internal and external client IPs and blocking others.
Rohit K.
Comprehensive Security with Minimal Tuning
Reviewed on Feb 16, 2026
Review provided by G2
What do you like best about the product?
I basically like that Check Point CloudGuard WAF provides all the protection without heavy tuning. It preemptively blocks threats including WACP top 10 risks with accurate detection and low false positives. It doesn't just rely on static signatures but improves resilience through anomaly and behavior analysis. The unified dashboard and detailed logging make investigation straightforward. It works well across AWS, Azure, GCP, Kubernetes, and others. Once policies are stabilized, the maintenance is kind of predictable.
What do you dislike about the product?
Managing policies can become harder across many apps without proper governance. The learning process for anomaly models takes time and can require tuning to avoid initial noise. Visibility can be overwhelming. While the schema-driven validation in API protection is strong, sometimes it needs tailored rule sets for customized API patterns. The initial setup, although structured, was not trivial and required planning. Policy complexity increases at scale, and initial behavior tuning needs attention. Licensing and costing plans need to accommodate large deployments.
What problems is the product solving and how is that benefiting you?
I use Check Point CloudGuard WAF to solve core web application security issues by blocking malicious traffic and enforcing API validations. It also generates helpful logs and dashboards, improving our security workflow without manual intervention.
Rabindra K.
Effortless Hybrid App Security and Rock-Solid API Protection
Reviewed on Feb 13, 2026
Review provided by G2
What do you like best about the product?
What really stands out to me is how easy it is to manage across our hybrid environment it doesn’t care if our apps are in AWS, Azure, or on-prem, everything just works. The SSL offloading took a massive load off our backend servers, and the API protection has been rock solid. Honestly, I don’t have to think about WAF configs anymore, and that’s the dream.
What do you dislike about the product?
The reporting and logging could definitely be more intuitive I usually end up exporting logs just to make sense of them because the built-in tools feel clunky. Also, the dashboard sometimes takes a few extra seconds to load, which is more annoying than it should be for a product at this price point. Minor frustrations, but they add up.
What problems is the product solving and how is that benefiting you?
We were drowning in alert fatigue our old setup would ping us for every tiny anomaly, and half the time it was just noise. CloudGuard actually filters out the garbage and tells us what really needs attention, so my team can focus on actual threats instead of babysitting logs. It’s cut our incident response time in half and honestly made work a lot less stressful.
Telecommunications
Lower TCO and DevOps-Friendly Nano Agent
Reviewed on Feb 05, 2026
Review provided by G2
What do you like best about the product?
Total Cost of Ownership (TCO) is often lower because you don't need a full-time engineer just to babysit the WAF rules. The Nano agent is perfect in a devops environment
What do you dislike about the product?
Frustration where troubleshooting deep technical bugs results in a loop of being told to wait for a specific "hotfix" rather than receiving immediate configuration help.
Slow Response for Lower Tiers: If you aren't on a high-tier support plan, getting an L3 engineer on the phone for a P1 issue can take longer than desired.
Slow Response for Lower Tiers: If you aren't on a high-tier support plan, getting an L3 engineer on the phone for a P1 issue can take longer than desired.
What problems is the product solving and how is that benefiting you?
CloudGuard WAF uses contextual AI to stop manual rule tuning and alert fatigue. It solves the "zero-day gap" by blocking threats like Log4Shell preemptively. Benefit from a 0.81% false positive rate and auto-API discovery that finds "shadow" endpoints. While pricey and complex to license, it saves massive dev time via automation.