In a recent project, we had one of our clients, a major financial institution in Eastern Europe. They were trying to resolve some issues with bots having access to some tangible data in their application. They had an external firewall they were using, but it was not backing up whatever alerts that needed to be obtained to make sure things are well secured. We came in and configured Imperva Application Security Platform on the web application. We made sure the DDoS protection feature was activated, so the admin is also alerted to whatever attack is coming in and then they are able to do the right measures to make sure it is stopped.
External reviews
70 reviews
from
and
External reviews are not included in the AWS star rating for the product.
Strong policies and bot defenses have secured critical APIs and have reduced attack noise
What is our primary use case?
My main use case is regarding API Security, specifically trying to do some schema enforcement. I would say that is my main use case, so having to make sure the schema enforcement is done and also some DDoS protection in the aspect of web application firewalls and making sure DDoS protection is done also for bot protection, as well as some of the use cases I have had in recent projects.
What is most valuable?
Some of the best features are the policy tuning, where you are able to tune policies the right way without stress or much hassle. The DDoS protection, the OWASP Top 10 feature, and the bot protection feature are also excellent. The API security feature is particularly valuable because most attackers do not try to come in from where it is expected. Most attackers attack the API that is being used on a platform.
The policy tuning is one of the easiest features that I know. Once you are trying to customize a policy, you just need to understand what kind of policy you are trying to customize, go through the right place from the security to policies, then create a policy. For example, you might be trying to set a policy to make sure that it does not save credit cards on a particular platform or website. That is basically one of the simplest ways of ensuring policy tuning works fine. It is one of the easiest features and I believe it has done a great deal for me in the aspect of operating Imperva Application Security Platform.
What needs improvement?
From my research regarding the IAM space that Imperva Application Security Platform is trying to look into, I believe they still need to do a lot of modeling and modification to make sure that also helps. There are several competitors in the IAM space, so Imperva would do well if they can do some basic modeling and modifications from my own personal research and my own experience in the IAM space. Alternatively, they could actually just focus on trying to be stronger in the web application space and the database activity monitoring space.
The main reason it is not a perfect ten is regarding support. At times, having to reach the support team takes eight hours to ten hours maximum. There are times when clients could have urgent issues to attend to. The support team could do more by having a faster response rate.
For how long have I used the solution?
I have been working for over three years in this space.
What do I think about the stability of the solution?
Imperva Application Security Platform is very stable, very, very stable.
What do I think about the scalability of the solution?
The scalability of Imperva Application Security Platform is easy and well organized, so you can easily upgrade the version of the model you are using. It is easy to always scale to add more users. It is easy to always scale to add more endpoints and apps you are trying to secure.
How are customer service and support?
For the customer support, the reason I rated Imperva nine over ten is basically because of the customer support. They need to work faster on the response time because of issues of urgent replies. They need to work perfectly on the faster response. Overall, it is a good customer experience with them. It has not really been hectic, but they can do better.
Which solution did I use previously and why did I switch?
We did not use any previous solution regarding that. We were always on Imperva Application Security Platform because Imperva is one of the leading organizations regarding WAF and DAM.
How was the initial setup?
Regarding licensing, it was a smooth experience. I had to reach out to the salesperson at Imperva who helped us with setting up costs and understanding what the client needs, and making sure the pricing and licensing is done. Licensing is always for a year. There are times when most of our clients do not actually remember where they do their licensing. The licensing certificate helps to understand the date and then gives the client the proper time to renew when necessary.
What was our ROI?
I was able to save over seven million dollars last year as return on investment in the company. Regarding fewer employees needed, we are able to employ more hands because we were one of the organizations that actually brought Imperva to Africa. We needed more Imperva engineers and from the way it is, Imperva engineers have not been that much in Africa. Training new employees and making sure they are attended to with Imperva is also an issue that we are trying to resolve in Africa.
What's my experience with pricing, setup cost, and licensing?
We have noticed faster response times and fewer security alerts because after doing some custom policy tuning, everything seemed to be aligned and we have fewer attacks to monitor and fewer alerts to monitor. It was possible where we were able to integrate a SIEM solution that we were using with Imperva Application Security Platform. That is one of the features I enjoy about Imperva. You can stimulate and integrate whatever SIEM platform you are using to Imperva. Imperva sends over the logs and alerts to the SIEM, so it is easier for the blue team of your organization to read the alert and provide adequate measures to stop whatever is happening in the enterprise.
Which other solutions did I evaluate?
We evaluated Trendis and we also evaluated Check Point.
What other advice do I have?
My basic advice would be to make your evaluations properly. It is okay to do demos as much as you can to fully see if it is going to work with whatever challenges you are trying to solve. I believe in thorough and proper evaluation of solutions. I can give a solid approval of Imperva Application Security Platform because it has really done a lot in helping my clients and giving them the best. Imperva is one of the best, if not the best. Almost every feature in Imperva Application Security Platform works really fine and it is what enterprises are battling, and what Imperva does in shaping the security culture of the digital world. Overall, I am going to rate Imperva Application Security Platform a nine out of ten, being one of the leading solution providers in the WAF space and the DAM space.
Which deployment model are you using for this solution?
Hybrid Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Advanced API inspection has protected critical banking integrations and supports real-time analysis
What is our primary use case?
I use Imperva Application Security Platform for API security, which has a cloud solution where normal traffic flows horizontally, and a copy of the traffic goes to the cloud to be inspected. If there is something suspicious, it could be blocked depending on the action configured. Imperva Application Security Platform also has a solution for Database Activity Monitoring (DAM) as well as API security. I have been working with these solutions for around one and a half years, more than one year, as a partner collaborating with the vendor. The communication from the vendor flows through us, then to the clients, particularly the financial institutions and banks.
The data center for the bank is usually the headquarter, where the main data center is located in our country, and there are branches at every street. For the branches, every access is through the firewall and the core banking application server, and there is an integration between banks from different institutions. In this case, every communication is done through the API, necessitating API inspection and API security.
The main benefit is the use case my clients find valuable. For the product and security, there is good API inspection. If any abnormal API appears or there are any similarities due to changes, the API security features will catch that because there is access for third-party applications from one bank to another. This setup ensures there is segmentation, and allowed APIs will get access while others will be blocked. It serves as the main channel for third-party application integration, and without API security, any similar URL related access could affect core banking, which is vital for every financial transaction.
For real-time analysis, the deployment is arranged so as not to interrupt transactions. The normal traffic flow will continue, while a copy of the API traffic will be mirrored to Imperva Application Security Platform for deep inspection. If any abnormalities are detected, even unusual behaviors for transactions, checks are done continuously, and actions are sent accordingly if any suspicious traffic is found.
What is most valuable?
For the fast response of signature-based comparisons, traffic will be matched against the solutions stored in the database to release actions if similarities occur. However, the main drawback for signature-based approaches happens when there is a new zero-day attack that is not in the database. Solutions usually include integrity with lab environments so that zero-day attack signatures are sent through subscriptions to provide the latest updates.
The comparison for API protection varies across solutions. For F5, API protection is part of WAF, and similarly for Fortinet. While Imperva Application Security Platform has basic features as part of WAF, its dedicated API protection solution is a strong point.
What needs improvement?
On the negative side, API security mainly supports cloud-based solutions, while most of my customers prefer on-prem setups, so achieving high performance with on-prem solutions would be beneficial. The attractiveness of Imperva Application Security Platform is that not all data is exposed to the cloud. Only a mirrored copy goes to the cloud and is inspected, allowing actions to be taken on-prem. To convince my clients, a purely on-prem solution would be ideal since they are financial institutions.
For how long have I used the solution?
I have been using the solution for more than one year.
What do I think about the stability of the solution?
I am more than happy with the technical support from Imperva Application Security Platform regarding data security and API security. For the support, however, one notable drawback is that, unlike Fortinet, which offers fast track labs and continuous enablement, Imperva Application Security Platform lacks lab access and fast track labs for enablement and product advertising. This weakness has shifted the marketplace toward other vendors. When creating a ticket for support during deployment, the response is satisfactory, though the gaps in enablement and lab sessions are clear.
What do I think about the scalability of the solution?
I find Imperva Application Security Platform to be a scalable product, as long as I subscribe and pay for the application I wish to use. It is scalable, and for about one and a half years, I have experienced no challenges in this area. I have not even needed support after deployment, since it has remained stable.
How are customer service and support?
When creating a ticket for support during deployment, the response is satisfactory, though the gaps in enablement and lab sessions are clear. Overall, I would rate support around an eight or nine, and my overall experience with security products spans around four years, with my particular engagement with Imperva Application Security Platform mainly during project deployment and client training.
How was the initial setup?
For installation, it primarily involves a cloud-based service, and I was using that as an operator. For database activity monitoring, I have deployed it, and while it is somewhat complex, there is a support channel where I communicate with vendors to resolve issues. The main challenge during installation is not unique to Imperva Application Security Platform. It is faced by many on-prem and virtual appliance products, particularly ensuring integrity with the virtualization environment and integration with third-party applications.
What other advice do I have?
I am not using CyberArk, as it is only a proposal for identity and access management that I have proposed for my clients.
Apart from One Identity, I am working with SentinelOne for AI, and I was looking for that. For Purple AI, I was communicating with the vendors and the distributor, and I have considered proposing it for my clients. Currently, I am using the load balancer Radware as an application load balancer. For the on-prem WAF, I am using Fortinet, regarding the WAF and the load balancer, Radware and Fortinet.
I am not working with some email security products, some EDR, or endpoint protection as an implementation. I was just looking into it and have proposed it for my clients, and I am waiting for the financial evaluation for FortiMail. For Fortinet, I am involved more with FortiMail, WAF, ADC, FortiGate firewall, NAC, WAF, and FortiClient EMS.
Regarding Check Point and WatchGuard, I have worked with Check Point for the firewall, specifically the perimeter firewall. For Check Point, I have already worked with the firewall only, which is a next-generation firewall, using a physical appliance on-prem. Most of my customers, particularly financial institutions, even if they invest their resources in the cloud, need an on-prem solution. It could be a virtual appliance deployed on a server or a physical appliance, but they mostly need on-prem.
Regarding the price, I find Imperva Application Security Platform affordable, with moderate pricing. My overall rating for this solution is eight out of ten.
Advanced threat detection has improved real-time traffic protection and mitigates DDoS attacks
What is our primary use case?
Clients can use Imperva Application Security Platform for various purposes, and as a reseller, I believe the best advantage in the product is its features that stand out for the client.
What is most valuable?
I have experience with the real-time traffic inspection feature of Imperva Application Security Platform, and it helps with network security.
I believe the reputational analysis in Imperva Application Security Platform is effective for blocking security threats before impact. I also believe that behavioral and signature-based techniques help to improve threat detection accuracy.
I see valuable benefits from advanced detection and traffic profiling during DDoS attacks, and I track some metrics related to DDoS protection performance.
What needs improvement?
I see some areas for improvement in Imperva Application Security Platform, especially regarding price. Regarding return on investment, ROI, I can say it is noticeable with Imperva Application Security Platform, and I see some significant differences compared to other firewalls such as Palo Alto, where there are pros and cons between Imperva Application Security Platform and some competitors.
As for the deployment of Imperva Application Security Platform, I would say it can be a complex process, and I ask this because we are partners with AWS. I have not purchased a solution from AWS Marketplace or deployed it on AWS Cloud for a client.
For how long have I used the solution?
I have been working and selling it for three years so far.
What do I think about the stability of the solution?
Regarding the scalability of Imperva Application Security Platform, I would say it is a scalable product with some limitations, but it is also a stable product without much glitch or downtime.
How are customer service and support?
My experience with technical support from Imperva Application Security Platform was good when I reached out to them.
How would you rate customer service and support?
Negative
Which solution did I use previously and why did I switch?
I have been in this domain with firewalls longer than three years, overall in this sphere with firewalls and security solutions.
What was our ROI?
I see some areas for improvement in Imperva Application Security Platform, especially regarding price. Regarding return on investment, ROI, I can say it is noticeable with Imperva Application Security Platform, and I see some significant differences compared to other firewalls such as Palo Alto, where there are pros and cons between Imperva Application Security Platform and some competitors.
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Have noticed several areas that need improvement while some features are helpful during deployment
What is our primary use case?
I prefer not to do a review for EDR since it is a new product that I am using. Instead, I would like to review other products I have worked with before, such as Imperva products, Imperva Web Application Firewall, or Imperva DAM.
What is most valuable?
I worked as a consultant for the customer and was part of a design and deployment team for Imperva API Security.
What needs improvement?
Could you please describe the deployment process, initial setup process, and what challenges were faced?
What was my experience with deployment of the solution?
I would need to check with my manager and run this by the legal team in the US before I would be able to share this information.
What do I think about the stability of the solution?
Please repeat the question.
What do I think about the scalability of the solution?
That would be fine.
How are customer service and support?
The technical support team would be rated 5 out of 10, where 10 represents the best support and 1 represents very poor support.
Which solution did I use previously and why did I switch?
I would prefer to receive the form via email so I can fill it out manually myself. Additionally, I want this review to be anonymous, with neither my name nor my company's name appearing anywhere.
How was the initial setup?
We can schedule a call in two hours to discuss this further.
What about the implementation team?
Please describe the deployment process, initial setup process, and what challenges were faced.
What other advice do I have?
I would need to check with my manager and run this by the legal team in the US before sharing more information. We can schedule a call in two hours to discuss this further.
Good solution but poor support in my region
What do you like best about the product?
It is a reliable cybersecurity solution that has many tools to help protect web applications.
What do you dislike about the product?
It is very expensive for our South American region and the support from the partners is bad.
What problems is the product solving and how is that benefiting you?
The technical support from the local partners is bad.
Solution ensures website availability and proactive threat mitigation
What is our primary use case?
Usually, I work with web DDoS Protection on the website.
DDoS protection of web requests on the website is the most common use case.
Companies that are working through the site, selling through the site, and so forth.
The most valuable feature of Imperva DDoS is to make our website available for our customers' requests 24 hours a day. This feature may be the most interesting for the financial sector, for banks.
What is most valuable?
Over the seven years, the most valuable features of Imperva DDoS that I have found are related to DDoS attacks, which are a group of attacks, and not all of them can be resolved on the endpoint level before the website. Using the web firewall before the website is a common use case to protect against malicious requests to the website.
I have utilized Imperva's Intelligent Traffic Filtering feature. This feature helps me understand how the attack is progressing and what is happening inside the requests to our website. It allows me to granularly grant or deny access to certain parts of our website. This helps when we know our customers and the types of requests that can be sent from them, enabling us to block some malicious requests.
Imperva DDoS has User Behavior Analytics and Threat Intelligence on its board, and this helps us to be protected proactively. Imperva DDoS connects to its database of threats, storing whole information about attacks all over the world in one simple engine. Everyone can use this feature, which can connect to this engine and get information about what is going on at the world level. That is the way to be protected at the company's level.
The integration capabilities of Imperva DDoS are very easy and simple. We can run it in 2 hours.
What needs improvement?
I would like to see improvements in the pooling of threats and attacks, possibly to enlarge the scale of indicators of compromise. For example, the initiation of an attack on the endpoint level could be combined into a big denial of service. Maybe Imperva DDoS could use endpoints to get information about the attacks before they commence from the endpoint level or establish cooperation with endpoint vendors to share this information.
For how long have I used the solution?
I have been working with Imperva DDoS for about 7 years.
What do I think about the stability of the solution?
The stability of Imperva DDoS is very good, as it seems they have a lot of servers around the world.
What do I think about the scalability of the solution?
The scalability of Imperva DDoS is very easy to manage. 99% of customers are using the cloud version of Imperva DDoS protection, so they just purchase the new license and scale as needed.
A popular use case for scalability challenges is when customers want to move from on-premise infrastructure to the cloud, having a transmission period where they use both a copy of infrastructure in the cloud and the current infrastructure in the on-premise offices. This means they need to use double capabilities to protect both connections to the cloud and to the on-premise part of the whole infrastructure. During this period, customers can buy a subscription with double the scale of the needed throughput of protection.
How are customer service and support?
I have interacted with the technical support of Imperva DDoS, and it is very easy. They are very professional, and communication goes through the technical support site. It's quite easy to register a support case and track the solution of your support ticket.
I would rate the technical support of Imperva DDoS as ten.
How would you rate customer service and support?
Which solution did I use previously and why did I switch?
Before Imperva DDoS, I used a different solution that was Unix-based and not commercial versions of products.
I switched from the previous solution to Imperva DDoS because we started to integrate the products, and we saw that the capabilities were much greater than what we used to have. We also had a technical engineer on board who can manage these solutions easily and has a deep understanding of what is happening with our websites during attacks.
How was the initial setup?
The initial setup and deployment of Imperva DDoS was quite easy. Customers just needed to provide the public IP address or the public name of their site, and we gave this information to Imperva DDoS to protect those sites. After the system is working, our technical engineer usually connects to configure some threat protection, role-based access control capabilities, reporting, and other minor configurations.
What about the implementation team?
I work as an integrator.
What was our ROI?
I have calculated return on investment with Imperva DDoS, particularly in the financial sector with bank accounts, where the calculation is straightforward. Banks usually calculate their loss when they are not working. They know how much money they are losing while the system is down, so by increasing the possibility of not having a down website or web application, return on investment can be calculated easily.
What's my experience with pricing, setup cost, and licensing?
The pricing, setup costs, and licensing of Imperva DDoS are reasonable for the amount of technical capabilities provided.
I would rate the pricing of Imperva DDoS as five, where one is very cheap and ten is very expensive.
Which other solutions did I evaluate?
I evaluated other options and vendors before choosing Imperva DDoS. We considered Akamai, but it was too expensive for us.
What other advice do I have?
I don't remember the last version of Imperva DDoS I am currently working with.
When customers change their DDoS protection to Imperva DDoS or integrate Imperva DDoS as a new single DDoS protection product, they achieve full satisfaction with international standards like PCI DSS and GDPR. This is a seamless integration with international standards.
I don't see any improvements needed for Imperva DDoS, because it is a very niche product with niche capabilities. It's not a technical thing, because it is continuously approved. Some features appear, but it's more about small improvements. The attacks Imperva DDoS is constructed to protect against are very well-known, and the solution is effective in protecting against them. The system can protect against even zero-day attacks.
We get Imperva DDoS free as part of an MSSP approach, but for our customers, the average deal size for one year could be around 10,000 dollars.
On a scale from one to ten, I rate Imperva DDoS a nine.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Experience swift configuration with enhanced web and mobile application security
What is our primary use case?
The solution functions just like a firewall, but it operates in the cloud. It is designed to protect web applications and environments hosted on the cloud.
It helps protect applications from DDoS attacks and other types of attacks. I handle a wide range of business requirements with it.
What is most valuable?
The solution can be configured in just a couple of minutes. It ensures 99.7% availability for my applications. It provides an additional layer of security for web applications and other applications, including mobile applications. It protects my environment and helps maintain my reputation in the market.
What needs improvement?
It is not a personal firewall, however, I can log my traffic to the Web Application Firewall if my hardware is available on-premise. I am satisfied with all the features available. There is nothing specific where the application firewall is falling short.
For how long have I used the solution?
I have been working with Imperva solutions personally since last month.
What do I think about the stability of the solution?
I would rate the solution ten out of ten in terms of stability.
What do I think about the scalability of the solution?
The solution is highly scalable. I can configure this firewall to expand based on my needs and revert to my basic configuration when traffic is over.
How are customer service and support?
Technical support is divided into two categories: partner side and OEM side. It is easy to contact them, and my queries are resolved efficiently.
How was the initial setup?
The initial setup is very easy. I just need to route the traffic, similar to configuring an IP on the application firewall. It typically takes no more than a day and is easy, rated at nine out of ten.
What's my experience with pricing, setup cost, and licensing?
The pricing is competitive in the market. The solution helps improve my security posture and operational costs.
Which other solutions did I evaluate?
There are other solutions available in the market, however, Imperva Web Application Firewall is a good solution.
What other advice do I have?
I would recommend Imperva Web Application Firewall to others.
Overall, I would rate it eight out of ten as it is a good solution. However, there are other solutions in the market.
Effective security breach prevention with automatic updates and customer-focused support
What is our primary use case?
We are a premier partner with Imperva. We usually recommend Imperva Web Application Firewall (WAF) more because our customers sometimes get a better deal, and many already have Imperva solutions on-premises. We help them move to the cloud and other related tasks.
How has it helped my organization?
Customers enjoy the rules implemented in Imperva WAF, which are updated automatically any time a new breach is discovered. This eliminates the need for backend changes or manual updates, making the system straightforward.
What is most valuable?
The valuable features of Imperva WAF include its effective security breach prevention through automatically updating rules. The support team answers cases quickly as well.
What needs improvement?
The product's customization capabilities are a bit problematic, requiring support cases for backend modifications.
Additionally, the handling of high-traffic volumes could be better, as it doesn't cut you off if you exceed your purchased traffic. Our clients like the guarantee that they won't be charged for exceeding traffic during peak periods. Users also need to be more attentive to false alerts, as the marketing might give a false sense of trust.
For how long have I used the solution?
I have been dealing with Imperva for three years, while my company has been involved for more years.
What do I think about the scalability of the solution?
Imperva WAF does not appear to handle high traffic volumes optimally during peaks as it only notifies clients if they exceed their purchased amount of traffic. However, it does not immediately cause any issue unless the excess persists over time.
How are customer service and support?
Their technical support is rated nine out of ten. Support cases are answered quickly.
How was the initial setup?
The setup is straightforward. Clients often manage it themselves, and no action is required on their end for implementation.
What about the implementation team?
On occasion, we help our clients get on the cloud as part of our partnership with Imperva.
What's my experience with pricing, setup cost, and licensing?
The pricing tends to be expensive. As premier partners, we get good deals, however, without such deals, it is usually quite costly. The cost also varies based on the plan that clients choose.
What other advice do I have?
Imperva Web Application Firewall is recommended for companies needing a robust cloud-based solution. For on-premises versions, it might be considered outdated.
I'd rate the solution nine out of ten.
Enhanced security with profile functionality
What is our primary use case?
I use the service for protection due to the fact that it has profile functionality.
What is most valuable?
Protection is the best solution since it has profile functionality.
Which other solutions did I evaluate?
Interesting alternatives are Akamai and some cloud solutions do exist.
Enhance security with ease through user-friendly administration and comprehensive threat prevention
What is our primary use case?
We use Imperva for our web applications that we have hosted to protect them.
How has it helped my organization?
With our deployment setup, the benefit is regarding the security and how threats have been blocked. It's not studied in terms of resources or speed. The threat prevention is the aspect we are monitoring.
What is most valuable?
Empower administration is user-friendly, and we do not need much for managing day-to-day operations. It is easy to use and has good security. Also, it is very customizable, especially for controlling web browsers and devices.
What needs improvement?
I would prefer AI integrations for user administration, visualization, log analytics, and risk analysis. If they can bring in generative AI features, that would be useful.
For how long have I used the solution?
I am working with Imperva at the moment and have been using it for maybe six to seven years.
What do I think about the stability of the solution?
It's very stable. We haven't had any issues.
What do I think about the scalability of the solution?
Scalability is not a problem since we have enough resources as it's an on-premises version.
How are customer service and support?
We have escalated to tech support and it's quite good. I would rate them a seven point five out of ten.
Which solution did I use previously and why did I switch?
We didn't use any WAF product before Imperva.
How was the initial setup?
The initial deployment was seamless, and there weren't many complexities.
What about the implementation team?
The deployment was done by a separate company within the company.
Which other solutions did I evaluate?
I do not have much understanding about F5 yet as I am currently evaluating their solution.
What other advice do I have?
I suggest looking for a cloud-based solution rather than on-premises, which might improve availability, stability, and security.
I'd rate the solution nine out of ten.
showing 1 - 10