I am using not only Fortinet, but I am also dealing with other vendors as well, such as Check Point. I am working with email security by Check Point. I have a little bit of experience with Check Point CloudGuard WAF, as we ran a proof of concept here.
CloudGuard WAF-as-a-Service (Advanced/Premium, Contract)
Check Point Software TechnologiesExternal reviews
82 reviews
from
and
External reviews are not included in the AWS star rating for the product.
Great Protection Without the Need to Be a Pro
What do you like best about the product?
CloudGuard WAF is an excellent non-cloud choice to keep the applications or website secured without being a security expert. It hides the background or ground level details of application and acts as a barrier layer in front of your site and automatically blocks unauthorized and DDos and others attacks.
What do you dislike about the product?
Just liek any other software out there Cloudguard does have some complex and rigid configuration policies which i really feel aren't worthy.
Sometimes configuration takes more time than actual benefits.
Sometimes configuration takes more time than actual benefits.
What problems is the product solving and how is that benefiting you?
It actually secures applications by just exposing it via secured channel which is more beneficial or public apps.
Its inbuilt support to stop the bot, SQLi, heavy body, DDos and more traffic is really appreciative of.
We can configure our own security rules to make sure what is allowed and what is not.
Its inbuilt support to stop the bot, SQLi, heavy body, DDos and more traffic is really appreciative of.
We can configure our own security rules to make sure what is allowed and what is not.
AI-Driven WAF with Minimal Manual Tuning
What do you like best about the product?
I like Check Point CloudGuard WAF because of its contextual AI that delivers near-zero false positives and automatic zero-day protection. I find it extremely valuable for providing strong automatic protection against zero-day threats with almost no false positives and requiring zero daily tuning effort.
What do you dislike about the product?
One area that could be improved is the initial learning period for very complex or highly dynamic applications, which sometimes requires a bit more manual exception tuning than I'd prefer in the first few weeks. Also, the initial setup/learning phase for complex apps can be a bit involved, and pricing feels premium, though the low-maintenance protection usually justifies it for serious environments.
What problems is the product solving and how is that benefiting you?
I expect Check Point CloudGuard WAF to solve zero-day attack exposure and reduce manual tuning and false positives. It offers strong, automatic protection with contextual AI, near-zero false positives, and minimal daily management, making it valuable for securing our cloud/web environments.
Effective Security with Easy-to-Use Interface
What do you like best about the product?
I like the Check Point CloudGuard WAF's GUI, which is very easy to use. It effectively helps in providing security to applications by allowing and blocking IPs, which is especially useful as we work on zero internet in our project. If we know an IP is part of our internal or external client, we can easily allow that IP. Check Point CloudGuard WAF's security is a key reason why we switched from using Azure Firewall.
What do you dislike about the product?
I think internal DNS needs to be removed. Also, the initial setup isn't easy, and when we try to resolve any ip it getting resolved but not from given source
What problems is the product solving and how is that benefiting you?
I use Check Point CloudGuard WAF to provide security to our application, allowing us to manage IPs by allowing internal and external client IPs and blocking others.
Effortless Hybrid App Security and Rock-Solid API Protection
What do you like best about the product?
What really stands out to me is how easy it is to manage across our hybrid environment it doesn’t care if our apps are in AWS, Azure, or on-prem, everything just works. The SSL offloading took a massive load off our backend servers, and the API protection has been rock solid. Honestly, I don’t have to think about WAF configs anymore, and that’s the dream.
What do you dislike about the product?
The reporting and logging could definitely be more intuitive I usually end up exporting logs just to make sense of them because the built-in tools feel clunky. Also, the dashboard sometimes takes a few extra seconds to load, which is more annoying than it should be for a product at this price point. Minor frustrations, but they add up.
What problems is the product solving and how is that benefiting you?
We were drowning in alert fatigue our old setup would ping us for every tiny anomaly, and half the time it was just noise. CloudGuard actually filters out the garbage and tells us what really needs attention, so my team can focus on actual threats instead of babysitting logs. It’s cut our incident response time in half and honestly made work a lot less stressful.
Lower TCO and DevOps-Friendly Nano Agent
What do you like best about the product?
Total Cost of Ownership (TCO) is often lower because you don't need a full-time engineer just to babysit the WAF rules. The Nano agent is perfect in a devops environment
What do you dislike about the product?
Frustration where troubleshooting deep technical bugs results in a loop of being told to wait for a specific "hotfix" rather than receiving immediate configuration help.
Slow Response for Lower Tiers: If you aren't on a high-tier support plan, getting an L3 engineer on the phone for a P1 issue can take longer than desired.
Slow Response for Lower Tiers: If you aren't on a high-tier support plan, getting an L3 engineer on the phone for a P1 issue can take longer than desired.
What problems is the product solving and how is that benefiting you?
CloudGuard WAF uses contextual AI to stop manual rule tuning and alert fatigue. It solves the "zero-day gap" by blocking threats like Log4Shell preemptively. Benefit from a 0.81% false positive rate and auto-API discovery that finds "shadow" endpoints. While pricey and complex to license, it saves massive dev time via automation.
Web protection has simplified basic rule setup but still needs better multi-site flexibility
What is our primary use case?
What is most valuable?
The efficiency improvements provided by Check Point CloudGuard WAF are something I can describe. It was fairly easy to set up Check Point CloudGuard WAF if you are looking at the basic configuration. It was pretty acceptable with setting up rules, and so forth. If you were looking for advanced configurations, then you had to go for a different setup, and that made it a little bit complicated.
In terms of efficiency, Check Point CloudGuard WAF is very straightforward to set up rules because you really do not need to do much customization, as it is the case with all Cloud WAFs.
I have been familiar with Check Point CloudGuard WAF for about six months.
What needs improvement?
Check Point could improve or add more flexibility when it comes to migrating to different sites. Multi-tenancy is an area where Check Point has room for improvement.
How are customer service and support?
From what I saw, the customer support by Check Point was pretty good, but they were trying to sell it to us, so I would rate it eight out of ten.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
I have experience with FortiWeb, although we just stopped using them. We used to have FortiWeb for the last few years, but now we have actually stopped using them.
Which other solutions did I evaluate?
The price of Check Point CloudGuard WAF is not expensive, as it was the cheapest solution we found. There is good competition for Check Point CloudGuard WAF at the moment, with big players in the market.
What other advice do I have?
If we selected Check Point CloudGuard WAF, which we did not, it would certainly be much cheaper. I would recommend Check Point CloudGuard WAF to others at a rating of seven out of ten. I would recommend it if you have a simple setup, then it is cheaper and it does the job. My overall review rating for Check Point CloudGuard WAF is seven out of ten.
Cloud security has improved and now consolidates multiple applications under one flexible firewall
What is our primary use case?
I can use Check Point CloudGuard WAF for multiple purposes, as I am using it as our cloud security posture management tool. I have started using it since cloud security posture management was sold to Wiz. Wiz is another product these days. I have started using Check Point CloudGuard WAF along with bot protection and API protection.
What is most valuable?
Check Point CloudGuard WAF provides great visibility and flexibility to use multiple FQDNs in a single load balancer. I am using multiple products with a similar solution, such as F5 and Check Point CloudGuard WAF. F5 operates with the discovery module and the API protection module only on a number of FQDN basis. This is a great, flexible option where I can implement multiple applications using a single load balancer.
The total cost of ownership has definitely reduced for my application firewall because there is no limitation on the load balancer for implementing FQDNs. FQDN is a fully qualified domain name. For example, I have an application on the load balancer with a.novaktech.one, and similarly, b.novaktech.one is another application, while c.novaktech.in is a third application. I can implement multiple FQDNs in a single load balancer.
Regarding the false positive rate, Check Point CloudGuard WAF has helped to reduce it as it gives more true positive cases rather than false positives. The technology leveraging Check Point's security provides threat intelligence where I can get DDoS and attack signatures and all AI/ML-based signatures. The false positive rate is very low. The approximately reduced false positive rate is about seventy percent. No product will give one hundred percent accuracy, but it detects seventy percent.
What needs improvement?
I see areas for improvement primarily on the reporting functionality front, as there are very limited functions in the reporting section. For example, I want to run a consolidated dashboard for the last six months, but it is not available.
Reporting functions alone have limitations, and sometimes this portal has latency issues when loading pages. Since I am using it as a SaaS platform, sometimes the loading pages take more time.
Regarding the Breach Reduction feature, I had a discussion with the Check Point account manager and pre-sale representative, but they have not yet provided a proof of concept demo. We are still in discussion.
For how long have I used the solution?
I am using the product for more than six months.
What do I think about the stability of the solution?
Regarding stability, I see no issues. Check Point CloudGuard WAF is quite stable and very reliable.
What do I think about the scalability of the solution?
I would say scalability is not a challenge with Check Point CloudGuard WAF, and there are no issues with scalability.
How are customer service and support?
The technical support from Check Point is good, especially since I am new to this particular product. They are providing good support currently.
How would you rate customer service and support?
Positive
How was the initial setup?
Check Point CloudGuard WAF is easy to deploy.
What other advice do I have?
If I were to rate the support from zero to ten points, I would give them nine points.
If I were to rate Check Point CloudGuard WAF on a scale from zero to ten points, I would give it nine points.
Regarding the solution's ability for preemptive blocking of zero-day attacks and detecting hidden anomalies, zero-day protection with Check Point products is very less compared to all other vendors. For example, I am using Fortinet and F5 as well. Every forty-five days, I have to forcefully update my firmware and other aspects, while I have never seen much zero-day vulnerability on Check Point CloudGuard WAF. Yearly, I only do the patch management and firmware upgrade. Compared to other service and security providers, the zero-day vulnerability on Check Point is very less. I know this because I am using all the products and understand the challenges. Check Point CloudGuard WAF has very low zero-day vulnerability, which is evident in security reports. My overall rating for this solution is nine out of ten points.
Strong ML-Based Protection, but Pricing, Setup, and Documentation Need Work
What do you like best about the product?
It can easily distinguish between attacks and legitimate traffic. It doesn’t require a lot of manual tuning, such as creating rules and policies. It protects using machine learning and AI, which helps prevent most attacks.
What do you dislike about the product?
I don’t like the pricing and the complexity of the initial setup. Log retention is limited, which creates issues with troubleshooting, and the documentation feels lacking—especially when it comes to real-world examples.
What problems is the product solving and how is that benefiting you?
It protects against SQL injection and XSS attacks that are often missed. It also reduces false positives, which means less overhead for the network security team. It helps stop automated botnets as well. Overall, it strengthens our network security.
Easy Cloud Setup with Strong Protection
What do you like best about the product?
The ease of set up and its strong protection. We were able to set up quickly in our cloud environment without a lot of complex configuration. The biggest plus is its minimal maintenance.
What do you dislike about the product?
UI feels a bit complex in the beginning, especially when we are trying to find specific settings or understand why something was blocked. Some features takes time to get used to.
What problems is the product solving and how is that benefiting you?
CloudGuard WAF helps us protect our web apps and APIs from common attacks and unwanted traffic without requiring a lot of manual effort. It also provides solid visibility into what’s happening with our traffic, which makes it easier to understand what’s being blocked and the reasons behind it.
Strong Security Features, but Setup and Management Can Be Challenging
What do you like best about the product?
I have been using the product for some time now, and I can honestly say it is highly effective against SQL injection, cross-site scripting, and bot threats. The automated rules make configuration appear very straightforward and simple.
What do you dislike about the product?
Configuring the system correctly requires a significant investment of time and a certain level of expertise, particularly when it comes to adjusting security rules to minimize false positives. Additionally, managing and reviewing policies can be somewhat cumbersome, as the interface is not always intuitive, especially when working with complex rule configurations or analyzing large volumes of traffic logs.
What problems is the product solving and how is that benefiting you?
As I have mentioned above the product is highly effective against SQL injection, cross-site scripting, and bot threats. The automated rules make configuration appear very straightforward and simple.
showing 1 - 10