Cloud security has strengthened risk posture and improved advanced threat visibility
What is our primary use case?
I use Check Point CloudGuard WAF for CSPM and posture management. In some places, I use native app protection-related management, and in other places, I use it for runtime protection. These are all some of the use cases I have utilized it for. I also use it for CASB in some locations, compliance assessment, adaptive access control, UEBA, policy enforcement, and threat protection. I have performed all of these functions using firewalls.
Traditional WAF with Check Point CloudGuard WAF has some features that could be integrated inside the WAF that might be helpful. I normally use a separate tool for API security, and I used to perform OWASP top 10 or 20 assessments. Not everything falls under WAF.
However, if it is included, especially in today's market where AI-related features are all integrated, that would be tremendously helpful. AI and modern viruses such as token theft, tool poisoning, command injection, unauthorized access, and prompt injection are all concerns. If you have prompt injection detection in Check Point CloudGuard WAF, that would be the greatest help for the market. I would give you one more thing called a rug pull attack. Prompt injection is critical to address. Today everything is prompt-based and AI-based, and there will definitely be some bots. Those bots will definitely cross this WAF. There are some modern AI-based vulnerabilities such as token theft and tool poisoning. Tool poisoning means that some malicious command will be hidden inside, and then passwords will be saved insecurely. This happens everywhere, sometimes by mistake or unintentionally, but these mistakes are what allow hackers to penetrate. Token theft, tool poisoning, token passthrough, command injection, rug pull attack, unauthenticated access, and prompt injection are all seven major problems for people like me, CISOs.
What is most valuable?
I have worked as a customer, partner, solutioner, and implementer. I have been with Check Point since Check Point NG's time. Check Point launched the new generation around 2000 if I understood correctly, and I have been with Check Point since then.
These kinds of Israeli products are strong, clever, and powerful tools. They are all strong, clever, and powerful tools compared with American products, to be honest and upfront. Palo Alto has beaten Check Point in the recent past by bringing these creamy layers of Israeli companies into their organization, if I understood correctly.
I am a CCSE by the way. Check Point Certified CCSE. I have been holding this certification for quite some time. In short, Check Point CloudGuard WAF is a powerful tool. In short, its look and feel is also not something everyone will like. People like me, a rare breed, will like Check Point CloudGuard WAF. Not everyone, to be honest.
There are some scoring companies I have worked with that focus on security scoring, risk scoring, and prioritization. These are all very good in Check Point CloudGuard WAF, I would say. Advanced threat detection is also fine. Check Point CloudGuard WAF also provides threat intelligence for us, which includes actionable information about current and emerging security threats. Check Point CloudGuard WAF produces all kinds of reports that involve collecting, analyzing, and sharing data about threat actors and their TTPs and IOCs. It is also strategic, tactical, technical, and operational. I like their threat intelligence products. It is strategic, tactical, technical, and operational.
What needs improvement?
There are some API gateway and API securities I mentioned. If these are incorporated with AI-related features, particularly those seven key vulnerabilities I mentioned—token theft and tool poisoning—that would be beneficial. AI-related features are not included yet in Check Point CloudGuard WAF. However, they are present in FortiGate. That is the advantage of FortiGate now. FortiGate is stopping all AI-related vulnerabilities now. FortiGate has this capability. It is unfortunate that even Palo Alto also lacks one or two of these features.
Check Point Quantum is very good, without a doubt. However, their capabilities are not in comparison with Palo Alto. There are some features, but there are some gaps in comparison with Palo Alto.
For how long have I used the solution?
I have been using this solution for a few months only.
What do I think about the stability of the solution?
I have not encountered glitches. There is something called implicit deny. Until I face any issues on the network as a CISO, such as issues due to the firewall being down or glitches, or if any vulnerabilities penetrated in, then I would be worried. However, by default, Check Point CloudGuard WAF will not be configured in that way.
How was the initial setup?
Based on what the customer is requesting, if the customer wants some third-party integration, such as Wazuh, which is a SIEM tool, or they want to deploy with some open source product, then complexity comes in. However, if we are only installing Check Point CloudGuard WAF, the deployment is very nice and very cool. Check Point CloudGuard WAF has very nice videos, deployment documents, and deployment guides available. I have seen it, run it, and installed it in various operating systems and appliances, as well as virtual appliances in the cloud.
What was our ROI?
I have seen ROI. However, when I am not worrying about the cost, I am also not worrying about the ROI. Selling a product is not my job. I am a CISO for a service organization. If you want, I will create the solution. When someone is requesting a solution, if that someone is also requesting ROI information, then I will give all of those metrics. However, it is a rare case that they will request ROIs, because I am not going to worry about the cost of the product. I am worrying about the features and vulnerabilities. Reduction of vulnerabilities is important. I hope you understand.
What's my experience with pricing, setup cost, and licensing?
Check Point CloudGuard WAF is expensive. It is a little bit expensive. You cannot avoid this from an Israeli product. Israeli products follow a certain pricing model. If they could reduce the cost a bit, then they can compete with Palo Alto. Palo Alto is leading, Cisco is down, and Palo Alto is coming up. There is something peculiar in the market. Cisco for the last three or four quarters has been very down. In fact, last year they made very less profits. However, Palo Alto was somewhere in the cloud. Check Point CloudGuard WAF is also coming up, but not the Palo Alto.
Which other solutions did I evaluate?
We do not care about alternate solutions. We never care about the cost. There is something called pair-wise comparison. I am a CISO, by the way. When any of the clients are in a process of deploying a firewall or global firewall for their organization, they will come to me and request, "CISO Krishna, why can't you give me the top three or four firewalls in the market?" I normally say the first one is Palo Alto, FortiGate, and then Check Point Quantum. These are the three top firewalls I usually recommend. I have a readymade PowerPoint deck in comparison, a pair-wise comparison with these three. In that comparison, there is the cost of each one and everything.
Cost is normally something I do not worry about. I will explain to the client, and it is their responsibility. Finally, they will choose the cheap one. Many people are going with FortiGate. And some people come to Check Point CloudGuard WAF. Rare people go for Palo Alto, or someone is really worried about their security, like banking organizations or financial institutes, those people go for Palo Alto.
I will not give any total cost of ownership about the product. I will give the features for this cost. I will explain the advantages, disadvantages, pros, and cons of each product, and then I will present it to the customer. It is up to the customer who will select the product, and we will also recommend. Sometimes we recommend Palo Alto, sometimes we recommend Check Point CloudGuard WAF, sometimes FortiGate, and sometimes other firewalls. In many places, we will not recommend. We will give it as it is. That is called pair-wise comparison. We will compare it and give it to the client, and it is the client's responsibility to choose their own product.
What other advice do I have?
I also use Orca and Palo Alto. With the four products — true positive, false positive, true negative, false negative — these are problems everywhere. That is the reason I recommend this tier-one firewall companies to the client. Out of ten, maybe one or two might be false positives.
AI-Driven WAF with Minimal Manual Tuning
What do you like best about the product?
I like Check Point CloudGuard WAF because of its contextual AI that delivers near-zero false positives and automatic zero-day protection. I find it extremely valuable for providing strong automatic protection against zero-day threats with almost no false positives and requiring zero daily tuning effort.
What do you dislike about the product?
One area that could be improved is the initial learning period for very complex or highly dynamic applications, which sometimes requires a bit more manual exception tuning than I'd prefer in the first few weeks. Also, the initial setup/learning phase for complex apps can be a bit involved, and pricing feels premium, though the low-maintenance protection usually justifies it for serious environments.
What problems is the product solving and how is that benefiting you?
I expect Check Point CloudGuard WAF to solve zero-day attack exposure and reduce manual tuning and false positives. It offers strong, automatic protection with contextual AI, near-zero false positives, and minimal daily management, making it valuable for securing our cloud/web environments.
Effective Security with Easy-to-Use Interface
What do you like best about the product?
I like the Check Point CloudGuard WAF's GUI, which is very easy to use. It effectively helps in providing security to applications by allowing and blocking IPs, which is especially useful as we work on zero internet in our project. If we know an IP is part of our internal or external client, we can easily allow that IP. Check Point CloudGuard WAF's security is a key reason why we switched from using Azure Firewall.
What do you dislike about the product?
I think internal DNS needs to be removed. Also, the initial setup isn't easy, and when we try to resolve any ip it getting resolved but not from given source
What problems is the product solving and how is that benefiting you?
I use Check Point CloudGuard WAF to provide security to our application, allowing us to manage IPs by allowing internal and external client IPs and blocking others.
Lower TCO and DevOps-Friendly Nano Agent
What do you like best about the product?
Total Cost of Ownership (TCO) is often lower because you don't need a full-time engineer just to babysit the WAF rules. The Nano agent is perfect in a devops environment
What do you dislike about the product?
Frustration where troubleshooting deep technical bugs results in a loop of being told to wait for a specific "hotfix" rather than receiving immediate configuration help.
Slow Response for Lower Tiers: If you aren't on a high-tier support plan, getting an L3 engineer on the phone for a P1 issue can take longer than desired.
What problems is the product solving and how is that benefiting you?
CloudGuard WAF uses contextual AI to stop manual rule tuning and alert fatigue. It solves the "zero-day gap" by blocking threats like Log4Shell preemptively. Benefit from a 0.81% false positive rate and auto-API discovery that finds "shadow" endpoints. While pricey and complex to license, it saves massive dev time via automation.
Cloud security has improved and now consolidates multiple applications under one flexible firewall
What is our primary use case?
I can use Check Point CloudGuard WAF for multiple purposes, as I am using it as our cloud security posture management tool. I have started using it since cloud security posture management was sold to Wiz. Wiz is another product these days. I have started using Check Point CloudGuard WAF along with bot protection and API protection.
What is most valuable?
Check Point CloudGuard WAF provides great visibility and flexibility to use multiple FQDNs in a single load balancer. I am using multiple products with a similar solution, such as F5 and Check Point CloudGuard WAF. F5 operates with the discovery module and the API protection module only on a number of FQDN basis. This is a great, flexible option where I can implement multiple applications using a single load balancer.
The total cost of ownership has definitely reduced for my application firewall because there is no limitation on the load balancer for implementing FQDNs. FQDN is a fully qualified domain name. For example, I have an application on the load balancer with a.novaktech.one, and similarly, b.novaktech.one is another application, while c.novaktech.in is a third application. I can implement multiple FQDNs in a single load balancer.
Regarding the false positive rate, Check Point CloudGuard WAF has helped to reduce it as it gives more true positive cases rather than false positives. The technology leveraging Check Point's security provides threat intelligence where I can get DDoS and attack signatures and all AI/ML-based signatures. The false positive rate is very low. The approximately reduced false positive rate is about seventy percent. No product will give one hundred percent accuracy, but it detects seventy percent.
What needs improvement?
I see areas for improvement primarily on the reporting functionality front, as there are very limited functions in the reporting section. For example, I want to run a consolidated dashboard for the last six months, but it is not available.
Reporting functions alone have limitations, and sometimes this portal has latency issues when loading pages. Since I am using it as a SaaS platform, sometimes the loading pages take more time.
Regarding the Breach Reduction feature, I had a discussion with the Check Point account manager and pre-sale representative, but they have not yet provided a proof of concept demo. We are still in discussion.
For how long have I used the solution?
I am using the product for more than six months.
What do I think about the stability of the solution?
Regarding stability, I see no issues. Check Point CloudGuard WAF is quite stable and very reliable.
What do I think about the scalability of the solution?
I would say scalability is not a challenge with Check Point CloudGuard WAF, and there are no issues with scalability.
How are customer service and support?
The technical support from Check Point is good, especially since I am new to this particular product. They are providing good support currently.
How would you rate customer service and support?
How was the initial setup?
Check Point CloudGuard WAF is easy to deploy.
What other advice do I have?
If I were to rate the support from zero to ten points, I would give them nine points.
If I were to rate Check Point CloudGuard WAF on a scale from zero to ten points, I would give it nine points.
Regarding the solution's ability for preemptive blocking of zero-day attacks and detecting hidden anomalies, zero-day protection with Check Point products is very less compared to all other vendors. For example, I am using Fortinet and F5 as well. Every forty-five days, I have to forcefully update my firmware and other aspects, while I have never seen much zero-day vulnerability on Check Point CloudGuard WAF. Yearly, I only do the patch management and firmware upgrade. Compared to other service and security providers, the zero-day vulnerability on Check Point is very less. I know this because I am using all the products and understand the challenges. Check Point CloudGuard WAF has very low zero-day vulnerability, which is evident in security reports. My overall rating for this solution is nine out of ten points.
Easy Cloud Setup with Strong Protection
What do you like best about the product?
The ease of set up and its strong protection. We were able to set up quickly in our cloud environment without a lot of complex configuration. The biggest plus is its minimal maintenance.
What do you dislike about the product?
UI feels a bit complex in the beginning, especially when we are trying to find specific settings or understand why something was blocked. Some features takes time to get used to.
What problems is the product solving and how is that benefiting you?
CloudGuard WAF helps us protect our web apps and APIs from common attacks and unwanted traffic without requiring a lot of manual effort. It also provides solid visibility into what’s happening with our traffic, which makes it easier to understand what’s being blocked and the reasons behind it.
Easy Implementation and Management
What do you like best about the product?
I like that Check Point CloudGuard WAF is easy to implement and manage, which is a standout feature for me. It was also a bit faster to implement access control. I appreciate the search criteria as it doesn't require specific parameters for troubleshooting, making it a more straightforward process.
What do you dislike about the product?
Nothing to be disliked yet
What problems is the product solving and how is that benefiting you?
Check Point CloudGuard WAF was faster to implement for access control and easier to manage, protecting our company's web application and improving over our previous solution.
Cloud security has improved and unified dashboards now provide clear threat visibility
What is our primary use case?
I use Check Point CloudGuard WAF for security purposes. We have multiple clouds deployed in AWS. I look after and manage the incoming threats, and if there are any possibilities, I check in the XDR, which we also have. It gives a unified solution.
I receive lots of false positive reports that I bifurcate and provide to my manager. I manage any threats that have entered or are coming, and any processes that have been run. I manage these and provide reports to the concerned department to validate them.
The solution for blocking zero-day attacks and detecting hidden anomalies is very good. I can see lots of threats and how they are being blocked. That is the best aspect of Check Point CloudGuard WAF solution.
What is most valuable?
The best feature in Check Point CloudGuard WAF is its user-friendly dashboard. It is very detailed in a bifurcated manner, providing each and every detail about every threat or process that has been run.
The efficiency improvements provided by Check Point CloudGuard WAF compared to traditional WAF products is that traditional products give much more false reports. I previously used Forcepoint WAF, which gave very false reports. Check Point gives a proper report, whereas I can see and validate that particular report. That is very useful in Check Point.
The main benefits that I have seen from using Check Point CloudGuard WAF is that the security posture is very good. It analyzes and delivers the threats, enriches the intelligence, and I get proper clarity in my organization. There are lots of APIs which I get through the security platform. The threat hunting provides details about how the threat has been run and how it is running in the sandbox.
Check Point CloudGuard WAF gives much more clarity in the organization about what traffic has been passed on which systems and switches. It gives complete clarity in a single dashboard. If any random person checks the console, they would understand what threats have been going on and what things have been running in my organization. That is the best part about it.
What needs improvement?
Currently, there is nothing in the areas of Check Point CloudGuard WAF that I would like to see improved or enhanced in the future. If there is anything in the roadmap, I would definitely like to try that particular segment, and I am also willing to add some new features with much more clarity. It depends upon the roadmap.
Features that I would like to see included in the future are pretty much all there, but if there are any other enhanced features that can be implemented, particularly the integration part with other products would be better. Some products do not get integrated, so if those products become compatible with Check Point CloudGuard WAF solution, that would be much better.
For how long have I used the solution?
I have been working with Check Point CloudGuard WAF product for the Web Application Firewall for two years.
What do I think about the stability of the solution?
I have not faced any stability issues with Check Point CloudGuard WAF.
What do I think about the scalability of the solution?
I do find Check Point CloudGuard WAF scalable.
How are customer service and support?
If any crucial updates or malfunction has happened with Check Point, I contact the TAC team. They are well responsive, and I like it very well.
On a scale of one to 10, I would rate the tech support around eight.
How would you rate customer service and support?
Which solution did I use previously and why did I switch?
In the past, I worked on Forcepoint WAF. Currently, I am working on Check Point CloudGuard WAF.
Before joining this organization, which was two years ago, there was a different solution in place. I got feedback from there that the particular solution was not able to provide detailed reports or detailed clarity that Check Point CloudGuard WAF solution provides. That is how they switched to Check Point CloudGuard WAF. The solution is not only user-friendly but also has lots of technologies and engines running, and depending upon how policies are set, false positive activity got reduced. I can customize the policies depending upon the reports, which helped reduce false positive reports.
Check Point CloudGuard WAF helped me reduce my false positive rate.
How was the initial setup?
The onboarding process and initial setup for me personally was pretty straightforward since it was in the cloud. There were no challenges, and it was perfectly fine.
What about the implementation team?
We did not deploy Check Point CloudGuard WAF ourselves. We involved a partner who deployed it and then handed it over to us.
What was our ROI?
Check Point CloudGuard WAF product does reduce the TCO, Total Cost of Ownership, for my Web Application Firewall.
What's my experience with pricing, setup cost, and licensing?
The setup cost was taken with the head of the department, who handled the pricing and everything.
Which other solutions did I evaluate?
The key differences, both pros and cons of Check Point CloudGuard WAF compared to other WAF technologies that I have worked with are very much in favor of Check Point CloudGuard WAF, because it provides entire cloud security and security postures. I do not think there are any cons currently.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Proactive Threat Prevention with Easy Setup
What do you like best about the product?
I appreciate the proactive and AI-driven threat prevention offered by Check Point CloudGuard WAF. It effectively detects and blocks threats like SQL injections, remote code execution, and automated bots without the need for traditional signature updates. This advanced AI-driven security extends protection against a wide range of threats, including zero-day exploits and API attacks, all with minimal effort. I find the product’s capability to ensure comprehensive threat coverage with reduced manual intervention to be highly valuable. Additionally, the initial setup process is very easy, which facilitates a smooth adoption and fast deployment.
What do you dislike about the product?
The steep learning curve is largely due to the sheer number of features and the extensive configuration needed before the system feels truly comfortable to use. With so many profiles, protections, exception paths, and tuning options available, it can be difficult to determine exactly what is necessary from the very beginning.
What problems is the product solving and how is that benefiting you?
I use Check Point CloudGuard WAF to protect web applications by automatically detecting and blocking threats like SQL injections and API attacks, without needing traditional signature updates.
Strong Protection, Overwhelming Setup
What do you like best about the product?
I appreciate Check Point CloudGuard WAF's ability to provide a balance between strong protection and low maintenance. The product effectively shields our web applications on AWS by allowing straightforward rule setup for API protection, virtual patching, and blocking common web attacks. One of the standout features for me is the ability to apply virtual patches instantly, which is crucial when developers need more time to address vulnerabilities. I also find the auto-updates to threat signatures invaluable for keeping us protected against the latest threats. The learning mode is another advantage, as it quickly propagates policy changes, allowing our security measures to adapt swiftly. Switching to Check Point CloudGuard WAF from AWS WAF has resulted in stronger, more automated protection with enhanced visibility, which aligns perfectly with the time constraints we face. This product delivers a robust solution while minimizing the hands-on management typically required.
What do you dislike about the product?
I find the initial setup of Check Point CloudGuard WAF overwhelming. Upon logging in, the dashboard presents many menus, which can be quite daunting. Implementing a more intuitive feature such as a 'Connect Cloud Environment' could significantly ease this process.
What problems is the product solving and how is that benefiting you?
I use Check Point CloudGuard WAF to protect web apps with virtual patching, strong API defense, and automatic threat updates, balancing strong protection with low maintenance. It also automates tasks that were too manual with AWS WAF, enhancing efficiency and visibility.
