Check Point CloudGuard WAF's primary use is protecting web applications and APIs from application layer attacks in the cloud. I also use it to protect public-facing apps.
CloudGuard WAF
Check Point Software TechnologiesExternal reviews
86 reviews
from
and
External reviews are not included in the AWS star rating for the product.
Centralized Protection with Seamless Cloud Integration
What do you like best about the product?
I like most about Check Point CloudGuard WAF is its seamless integration with cloud environments and the ability to enforce consistent security policies across multiple platforms through a single console. It also provides strong centralized protection and cloud-native integration. The initial setup was relatively simple thanks to the cloud-native integration and automated policy template.
What do you dislike about the product?
One area that could be improved is the initial setup and policy tuning, which can feel complex and time-consuming, especially for teams without deep prior experience with Check Point's ecosystem.
What problems is the product solving and how is that benefiting you?
I use Check Point CloudGuard WAF to protect our cloud-native applications from web attacks, centralize security policy management, automate defense, and solve the challenge of securing distributed cloud applications with unified visibility, automated threat prevention, and simplified compliance management.
Centralized Security with a Learning Curve
What do you like best about the product?
I like the single pane of glass management that Check Point CloudGuard WAF offers, providing consistent policies across all cloud environments. I appreciate how it enforces granular, context-aware security policies across multi-cloud, protecting my cloud-native applications from web exploits and bots. I also find its centralized security management across multi-cloud environments valuable, as it eliminates the complexity of maintaining disparate WAF solutions and stops sophisticated attacks like SQL injection and zero-day exploits. Additionally, I use it with SIEM platforms like Splunk for centralized logging and threat correlation, and I integrate it with CI/CD pipelines such as Jenkins to automate security policy deployment. Overall, it delivers powerful security.
What do you dislike about the product?
The setup and policy tuning have a steep learning curve, and the reporting dashboard could be more intuitive.
What problems is the product solving and how is that benefiting you?
I use Check Point CloudGuard WAF to protect my applications from web exploits and bots, centralize security across multi-cloud environments, and reduce manual effort for consistent compliance.
Cloud protection has reduced manual effort and now improves web and API security operations
What is our primary use case?
What is most valuable?
Check Point CloudGuard WAF offers the best features through its dual ML engine with attack-based and context-based capabilities. The dual engine directly reduces the operational load and improves detection quality for my team on a day-to-day basis.
Additionally, it allows for less policy tuning. Check Point CloudGuard WAF has positively impacted my organization by reducing my manual effort. It reduces up to 2x my operational effects, leading to lower false positives.
What needs improvement?
While Check Point CloudGuard WAF is a strong solution, it could be improved in a few areas such as simplifying and customizing the user interface and reporting database. Improving API security depth is also necessary.
For how long have I used the solution?
I have been using Check Point CloudGuard WAF for the last one year.
What do I think about the stability of the solution?
Check Point CloudGuard WAF is stable in my experience.
What do I think about the scalability of the solution?
Check Point CloudGuard WAF is highly scalable and designed for cloud-native environments.
How are customer service and support?
The customer support is really good. I would rate the customer support an eight on a scale of one to ten.
Which solution did I use previously and why did I switch?
Before Check Point CloudGuard WAF, we did not use any WAF solution.
What was our ROI?
I have seen a return on investment as it is a time-saver product.
What other advice do I have?
Check Point CloudGuard WAF delivers clear efficiency gains over traditional WAFs in three main areas: operations, accuracy, and cost optimization. I do utilize Check Point CloudGuard WAF alongside other Check Point products. We use Check Point firewalls, security gateway, and load balancer, and they work together with Check Point CloudGuard WAF in our environment. My advice for others looking into using Check Point CloudGuard WAF is to first validate the use case and plan the deployment architecture. I would rate this product a nine on a scale of one to ten.
Cloud security has improved as we protect critical apps and APIs with adaptive threat prevention
What is our primary use case?
The major use case is providing application security and API security solutions to the organization. For example, our client was HYG, and they wanted to ensure their applications and API security gets fully secured, which is why I proposed Check Point CloudGuard WAF to their solution.
What is most valuable?
The biggest benefit from Check Point CloudGuard WAF that I saw is that it comes with one solution that completely outperforms its competitors. While there are other vendors such as Azure or AWS that provide their own WAF solution, that is comparatively not good enough. Check Point CloudGuard WAF prevents everything, their applications, their APIs, protecting them completely from DDoS attacks. It also has an AI feature that learns automatically from patterns, implying remediation to mitigate regular attacks on the network.
Breach reduction occurs when there is a compliance issue or vulnerability within the organization. Since Check Point CloudGuard WAF has the capability to learn itself, as it understands the patterns of risks and attacks, it auto-generates remediation plans by itself, thus effectively reducing breaches on this platform.
What needs improvement?
The negative side I see is that while most things about Check Point CloudGuard WAF are really good, there is some latency and performance issues, as it can be slow to log in, especially from different regions. The pricing is another concern, as it is on the higher side and more suitable for mid-level or large enterprises rather than small organizations.
The quality of the technical support team could be better; I rate them as okay, not excellent.
To improve support, response time needs attention, as it can be hard to connect with the team. First, one must speak to the level one team, then the case must be transferred to levels two or three, leading to delays due to multiple teams managing different issues. This process means the customer can face delays in getting the right assistance.
Latency and performance issues, friendlier pricing, and support are major concerns for improvement.
For how long have I used the solution?
I have been working with the products for approximately eight to ten months.
What do I think about the stability of the solution?
For stability, I would give it 8.5 points out of 10.
What do I think about the scalability of the solution?
Check Point CloudGuard WAF is easy to scale and does not present many challenges, making it very easy to scale without limitation.
How are customer service and support?
The quality of the technical support team could be better; I rate them as okay, not excellent.
How was the initial setup?
Deployment of Check Point CloudGuard WAF is easy, as it comes with different modes depending on the agent that needs to be installed. Overall, it is simple and not very complex.
What was our ROI?
I observe a good return on investment from the product, as investing in securing clients proves worthy. If a serious breach happens, the cost to fix it could be in the millions, so preventing it is always beneficial for your investment.
Which other solutions did I evaluate?
There are significant differences, as specifically for Check Point CloudGuard WAF, it outperforms competitors such as Cloudflare regarding accuracy and remediation. While Cloudflare is less expensive, it is not completely reliable. In contrast, Check Point CloudGuard WAF, despite being somewhat expensive, is completely reliable.
What other advice do I have?
I was working with Check Point CloudGuard WAF as a service provider, providing support to our clients from the Check Point CloudGuard WAF point.
When I assess the efficiency improvements provided by Check Point CloudGuard WAF compared to traditional WAF, I find that in traditional WAFs, we had to purchase a physical device or license from companies such as F5 or Cloudflare, which were really good in the market. However, since it has moved to the cloud, it completely goes virtual, meaning you don't have to buy or manage your own physical devices, making implementation really easy and very efficient with just a one-time purchase of the license from Check Point CloudGuard WAF.
Integration capability with existing systems was easy, as all vendors these days, such as Check Point, Fortinet, and Cisco, provide everything inbuilt. If you use the same vendor's firewall or EDR, it is easier to integrate their tool rather than purchasing from different vendors, which can become complex and challenging for engineers. When it is from the same vendor, managing different solutions is having only one platform to log in to.
Check Point CloudGuard WAF absolutely helps reduce the false positive rate, which is really very good, as the false positive rate is very low. The approximate false positive rate is one percent.
In assessing the solution for preemptively blocking zero-day attacks and detecting hidden anomalies, I find Check Point CloudGuard WAF amazing because it works on two engines: supervised and unsupervised. For zero-day attacks, it resolves issues immediately without waiting for another 24 hours or seven days.
I would rate the pricing at seven points, indicating it is expensive. I would rate this review overall as an 8 out of 10.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Solid Protection with Machine Learning; Console Improvable
What do you like best about the product?
I greatly appreciate the machine learning engine of Check Point CloudGuard WAF for prevention, because it automates much of the complex work of rule management, drastically reducing false positives. I don't have to write custom rules from scratch and the policies adapt well to real traffic after the initial learning period. Additionally, I like the security policy updates that come from the cloud without me having to intervene manually. The preemptive bot protection is very effective, clearly distinguishing between good and malicious bots, and the automatic API discovery is convenient for mapping APIs and detecting unprotected endpoints. The unified console for policy management across different environments, cloud and on-prem, is very useful to avoid maintaining separate stacks.
What do you dislike about the product?
The management console could be improved; sometimes you have to click too many times to find specific information, and the logging system is not granular enough during troubleshooting. The documentation lacks concrete examples for real use cases, and more practical troubleshooting support would be helpful. Integration with Splunk requires writing custom parsing, and support for configuration as code has room for improvement.
What problems is the product solving and how is that benefiting you?
Check Point CloudGuard WAF manages false positives using machine learning, better protecting APIs and reducing bot traffic. It unifies management on cloud and on-premises, simplifying work compared to the past, but the management console has room for improvement.
Cloud security has strengthened risk posture and improved advanced threat visibility
What is our primary use case?
I use Check Point CloudGuard WAF for CSPM and posture management. In some places, I use native app protection-related management, and in other places, I use it for runtime protection. These are all some of the use cases I have utilized it for. I also use it for CASB in some locations, compliance assessment, adaptive access control, UEBA, policy enforcement, and threat protection. I have performed all of these functions using firewalls.
Traditional WAF with Check Point CloudGuard WAF has some features that could be integrated inside the WAF that might be helpful. I normally use a separate tool for API security, and I used to perform OWASP top 10 or 20 assessments. Not everything falls under WAF.
However, if it is included, especially in today's market where AI-related features are all integrated, that would be tremendously helpful. AI and modern viruses such as token theft, tool poisoning, command injection, unauthorized access, and prompt injection are all concerns. If you have prompt injection detection in Check Point CloudGuard WAF, that would be the greatest help for the market. I would give you one more thing called a rug pull attack. Prompt injection is critical to address. Today everything is prompt-based and AI-based, and there will definitely be some bots. Those bots will definitely cross this WAF. There are some modern AI-based vulnerabilities such as token theft and tool poisoning. Tool poisoning means that some malicious command will be hidden inside, and then passwords will be saved insecurely. This happens everywhere, sometimes by mistake or unintentionally, but these mistakes are what allow hackers to penetrate. Token theft, tool poisoning, token passthrough, command injection, rug pull attack, unauthenticated access, and prompt injection are all seven major problems for people like me, CISOs.
What is most valuable?
I have worked as a customer, partner, solutioner, and implementer. I have been with Check Point since Check Point NG's time. Check Point launched the new generation around 2000 if I understood correctly, and I have been with Check Point since then.
These kinds of Israeli products are strong, clever, and powerful tools. They are all strong, clever, and powerful tools compared with American products, to be honest and upfront. Palo Alto has beaten Check Point in the recent past by bringing these creamy layers of Israeli companies into their organization, if I understood correctly.
I am a CCSE by the way. Check Point Certified CCSE. I have been holding this certification for quite some time. In short, Check Point CloudGuard WAF is a powerful tool. In short, its look and feel is also not something everyone will like. People like me, a rare breed, will like Check Point CloudGuard WAF. Not everyone, to be honest.
There are some scoring companies I have worked with that focus on security scoring, risk scoring, and prioritization. These are all very good in Check Point CloudGuard WAF, I would say. Advanced threat detection is also fine. Check Point CloudGuard WAF also provides threat intelligence for us, which includes actionable information about current and emerging security threats. Check Point CloudGuard WAF produces all kinds of reports that involve collecting, analyzing, and sharing data about threat actors and their TTPs and IOCs. It is also strategic, tactical, technical, and operational. I like their threat intelligence products. It is strategic, tactical, technical, and operational.
What needs improvement?
There are some API gateway and API securities I mentioned. If these are incorporated with AI-related features, particularly those seven key vulnerabilities I mentioned—token theft and tool poisoning—that would be beneficial. AI-related features are not included yet in Check Point CloudGuard WAF. However, they are present in FortiGate. That is the advantage of FortiGate now. FortiGate is stopping all AI-related vulnerabilities now. FortiGate has this capability. It is unfortunate that even Palo Alto also lacks one or two of these features.
Check Point Quantum is very good, without a doubt. However, their capabilities are not in comparison with Palo Alto. There are some features, but there are some gaps in comparison with Palo Alto.
For how long have I used the solution?
I have been using this solution for a few months only.
What do I think about the stability of the solution?
I have not encountered glitches. There is something called implicit deny. Until I face any issues on the network as a CISO, such as issues due to the firewall being down or glitches, or if any vulnerabilities penetrated in, then I would be worried. However, by default, Check Point CloudGuard WAF will not be configured in that way.
How was the initial setup?
Based on what the customer is requesting, if the customer wants some third-party integration, such as Wazuh, which is a SIEM tool, or they want to deploy with some open source product, then complexity comes in. However, if we are only installing Check Point CloudGuard WAF, the deployment is very nice and very cool. Check Point CloudGuard WAF has very nice videos, deployment documents, and deployment guides available. I have seen it, run it, and installed it in various operating systems and appliances, as well as virtual appliances in the cloud.
What was our ROI?
I have seen ROI. However, when I am not worrying about the cost, I am also not worrying about the ROI. Selling a product is not my job. I am a CISO for a service organization. If you want, I will create the solution. When someone is requesting a solution, if that someone is also requesting ROI information, then I will give all of those metrics. However, it is a rare case that they will request ROIs, because I am not going to worry about the cost of the product. I am worrying about the features and vulnerabilities. Reduction of vulnerabilities is important. I hope you understand.
What's my experience with pricing, setup cost, and licensing?
Check Point CloudGuard WAF is expensive. It is a little bit expensive. You cannot avoid this from an Israeli product. Israeli products follow a certain pricing model. If they could reduce the cost a bit, then they can compete with Palo Alto. Palo Alto is leading, Cisco is down, and Palo Alto is coming up. There is something peculiar in the market. Cisco for the last three or four quarters has been very down. In fact, last year they made very less profits. However, Palo Alto was somewhere in the cloud. Check Point CloudGuard WAF is also coming up, but not the Palo Alto.
Which other solutions did I evaluate?
We do not care about alternate solutions. We never care about the cost. There is something called pair-wise comparison. I am a CISO, by the way. When any of the clients are in a process of deploying a firewall or global firewall for their organization, they will come to me and request, "CISO Krishna, why can't you give me the top three or four firewalls in the market?" I normally say the first one is Palo Alto, FortiGate, and then Check Point Quantum. These are the three top firewalls I usually recommend. I have a readymade PowerPoint deck in comparison, a pair-wise comparison with these three. In that comparison, there is the cost of each one and everything.
Cost is normally something I do not worry about. I will explain to the client, and it is their responsibility. Finally, they will choose the cheap one. Many people are going with FortiGate. And some people come to Check Point CloudGuard WAF. Rare people go for Palo Alto, or someone is really worried about their security, like banking organizations or financial institutes, those people go for Palo Alto.
I will not give any total cost of ownership about the product. I will give the features for this cost. I will explain the advantages, disadvantages, pros, and cons of each product, and then I will present it to the customer. It is up to the customer who will select the product, and we will also recommend. Sometimes we recommend Palo Alto, sometimes we recommend Check Point CloudGuard WAF, sometimes FortiGate, and sometimes other firewalls. In many places, we will not recommend. We will give it as it is. That is called pair-wise comparison. We will compare it and give it to the client, and it is the client's responsibility to choose their own product.
What other advice do I have?
I also use Orca and Palo Alto. With the four products — true positive, false positive, true negative, false negative — these are problems everywhere. That is the reason I recommend this tier-one firewall companies to the client. Out of ten, maybe one or two might be false positives.
Great Protection Without the Need to Be a Pro
What do you like best about the product?
CloudGuard WAF is an excellent non-cloud choice to keep the applications or website secured without being a security expert. It hides the background or ground level details of application and acts as a barrier layer in front of your site and automatically blocks unauthorized and DDos and others attacks.
What do you dislike about the product?
Just liek any other software out there Cloudguard does have some complex and rigid configuration policies which i really feel aren't worthy.
Sometimes configuration takes more time than actual benefits.
Sometimes configuration takes more time than actual benefits.
What problems is the product solving and how is that benefiting you?
It actually secures applications by just exposing it via secured channel which is more beneficial or public apps.
Its inbuilt support to stop the bot, SQLi, heavy body, DDos and more traffic is really appreciative of.
We can configure our own security rules to make sure what is allowed and what is not.
Its inbuilt support to stop the bot, SQLi, heavy body, DDos and more traffic is really appreciative of.
We can configure our own security rules to make sure what is allowed and what is not.
AI-Driven WAF with Minimal Manual Tuning
What do you like best about the product?
I like Check Point CloudGuard WAF because of its contextual AI that delivers near-zero false positives and automatic zero-day protection. I find it extremely valuable for providing strong automatic protection against zero-day threats with almost no false positives and requiring zero daily tuning effort.
What do you dislike about the product?
One area that could be improved is the initial learning period for very complex or highly dynamic applications, which sometimes requires a bit more manual exception tuning than I'd prefer in the first few weeks. Also, the initial setup/learning phase for complex apps can be a bit involved, and pricing feels premium, though the low-maintenance protection usually justifies it for serious environments.
What problems is the product solving and how is that benefiting you?
I expect Check Point CloudGuard WAF to solve zero-day attack exposure and reduce manual tuning and false positives. It offers strong, automatic protection with contextual AI, near-zero false positives, and minimal daily management, making it valuable for securing our cloud/web environments.
Effective Security with Easy-to-Use Interface
What do you like best about the product?
I like the Check Point CloudGuard WAF's GUI, which is very easy to use. It effectively helps in providing security to applications by allowing and blocking IPs, which is especially useful as we work on zero internet in our project. If we know an IP is part of our internal or external client, we can easily allow that IP. Check Point CloudGuard WAF's security is a key reason why we switched from using Azure Firewall.
What do you dislike about the product?
I think internal DNS needs to be removed. Also, the initial setup isn't easy, and when we try to resolve any ip it getting resolved but not from given source
What problems is the product solving and how is that benefiting you?
I use Check Point CloudGuard WAF to provide security to our application, allowing us to manage IPs by allowing internal and external client IPs and blocking others.
Effortless Hybrid App Security and Rock-Solid API Protection
What do you like best about the product?
What really stands out to me is how easy it is to manage across our hybrid environment it doesn’t care if our apps are in AWS, Azure, or on-prem, everything just works. The SSL offloading took a massive load off our backend servers, and the API protection has been rock solid. Honestly, I don’t have to think about WAF configs anymore, and that’s the dream.
What do you dislike about the product?
The reporting and logging could definitely be more intuitive I usually end up exporting logs just to make sense of them because the built-in tools feel clunky. Also, the dashboard sometimes takes a few extra seconds to load, which is more annoying than it should be for a product at this price point. Minor frustrations, but they add up.
What problems is the product solving and how is that benefiting you?
We were drowning in alert fatigue our old setup would ping us for every tiny anomaly, and half the time it was just noise. CloudGuard actually filters out the garbage and tells us what really needs attention, so my team can focus on actual threats instead of babysitting logs. It’s cut our incident response time in half and honestly made work a lot less stressful.
showing 1 - 10