Check Point WAF (formerly CloudGuard WAF)
Advanced protection has secured APIs and simplified centralized network defense
What is our primary use case?
I have been working with Check Point WAF (formerly CloudGuard WAF) for 14 years.
Check Point WAF (formerly CloudGuard WAF) is particularly useful for protecting my network from external attacks, such as DDoS attacks and broken authentication.
Regarding which product of Check Point I would like feedback about, I chose Check Point WAF (formerly CloudGuard WAF) solution.
What is most valuable?
What I appreciate about Check Point WAF (formerly CloudGuard WAF) is that it has an auto-enabled CDN within it, which helps us because even if there are floodgates created by an attacker, the CDN gets enabled automatically, and the UI is well organized, so even if a graduate comes in and tries to explore it, they are able to do so.
Moreover, network segmentation can be done very easily using WAF.
The key benefits I have seen from using Check Point WAF (formerly CloudGuard WAF) is that it can be centrally managed, so if we have ten firewalls, they can be centrally managed through one center and one platform, which is one of the key features I appreciated.
Check Point WAF (formerly CloudGuard WAF) has improved my ability to discover, monitor, and protect APIs so that our security risk, which was ambient earlier, is now green, and the security posture assessment by third-party evaluators shows we are green.
What needs improvement?
Regarding the false positive rate, we need to configure it according to our environment because unless we configure it according to our environment, it's a tedious process, particularly with Check Point WAF (formerly CloudGuard WAF), and sometimes if it's not configured properly, there are more than 60% of false positives that we receive.
Apart from the configuration aspect, I would like to see improvements in false positives, and the second part is endpoint security because there is no agentless control. If endpoints can be managed using Check Point WAF (formerly CloudGuard WAF), that would be very beneficial, rather than it being just a firewall.
Check Point WAF (formerly CloudGuard WAF)'s AI-driven threat detection and prevention capabilities is one area wherein I believe Check Point lacks, as I did not find many AI features in Check Point, but compared to Palo Alto, they have better AI capabilities.
What do I think about the stability of the solution?
When it comes to stability and reliability, I find Check Point WAF (formerly CloudGuard WAF) stable.
We do have crashes, downtimes, and performance issues, but we receive good support from Check Point, so it is taken care of by the Check Point vendor.
What do I think about the scalability of the solution?
When it comes to scalability, I would rate it as nine out of ten, as it's very easy to scale, and whenever we bring in some VLANs or different networks, we can easily integrate them within Check Point WAF (formerly CloudGuard WAF).
How are customer service and support?
I would rate the technical support of Check Point as eight out of ten.
Which solution did I use previously and why did I switch?
Prior to adopting Check Point WAF (formerly CloudGuard WAF), I previously used a different solution called SentinelOne.
How was the initial setup?
Before implementing Check Point WAF (formerly CloudGuard WAF), I was trying to solve network security challenges, particularly all the challenges that exist for network security.
What about the implementation team?
I utilize Check Point WAF (formerly CloudGuard WAF) alongside Check Point Firewall, which is the basic firewall.
What was our ROI?
Since implementing Check Point WAF (formerly CloudGuard WAF), it has helped us to get more business, and along with that, we are able to prevent threats to our organization using Check Point WAF (formerly CloudGuard WAF).
What's my experience with pricing, setup cost, and licensing?
Apart from the pricing, other differences I found include that Check Point WAF (formerly CloudGuard WAF) is centralized, as ASA does not have centralized management, and although Palo Alto does, Check Point WAF (formerly CloudGuard WAF) is found to be more user-friendly.
Which other solutions did I evaluate?
The main reasons I selected Check Point WAF (formerly CloudGuard WAF) over other solutions were that it is a smarter firewall than others, and it was more cost-effective compared to Palo Alto, as they provided a lengthy quotation, and ASA is a legendary solution, but no one uses ASA nowadays.
What other advice do I have?
For assessing Check Point WAF (formerly CloudGuard WAF) for preemptively blocking zero-day attacks and detecting hidden anomalies, we particularly use CrowdStrike for that function, as we detect using CrowdStrike, and there is not much on Check Point WAF (formerly CloudGuard WAF)'s side.
For ZTNA, I can maintain a ZTNA using certain MFAs or enabling certain network controls, so on the ZTNA side, it performs well.
Regarding integration, how Check Point WAF (formerly CloudGuard WAF) and firewalls integrate with my existing systems, I find the integration with third parties straightforward as I have not encountered challenges, complexities, or needed to work on or enable anything there.
I do not find any challenges with the ongoing management of Check Point WAF (formerly CloudGuard WAF), so maintenance is very smooth, and I do not face any issues with that.
I purchased Check Point WAF (formerly CloudGuard WAF) through a vendor, not directly through Check Point Technologies.
Given my experience with Check Point WAF (formerly CloudGuard WAF) and other technologies, I recommend Check Point WAF (formerly CloudGuard WAF). I would recommend it primarily for its scalability, which is very easy to scale, and the integration capability, as we can integrate it easily with systems like Splunk or any other SIEM devices. My overall review rating for Check Point WAF (formerly CloudGuard WAF) is 8.5 out of 10.
AI-driven protection has secured our cloud APIs and reduced false positives for dynamic workloads
What is our primary use case?
My main use case for Check Point WAF (formerly CloudGuard WAF) is web application API protection in cloud-native, hybrid, and multi-cloud environments, where it provides automated AI-driven threat prevention, comprehensive API security, zero-day and OWASP Top 10 protection, as well as bot protection and DDoS mitigation.
As a scenario, I can describe a broken object level authorization attack where an enterprise is running a containerized microservice application deployed via Terraform or Docker. The front end communicates with the back-end service through a REST API, and user authentication is handled by a central identity and access management provider such as OAuth2. The attack vector involved an attacker logging in with valid, low-privilege user credentials, which led them to probe the application's back-end endpoint. After requesting their own authorized record, they deployed a script to iterate through other IDs to scrape sensitive data from other tenants. Since the API calls are perfectly formatted and authenticated, a legacy signature-based WAF would typically allow this traffic through. However, the mitigation flow includes automatic schema enforcement, behavioral baseline, IAM context awareness, and surgical blocking. By applying these techniques, we can shift from static rule maintenance to dynamic, context-aware analysis, which is where Check Point WAF (formerly CloudGuard WAF) applies.
What is most valuable?
The best feature Check Point WAF (formerly CloudGuard WAF) offers is API security.
The features that stand out to me within Check Point WAF (formerly CloudGuard WAF) include the contextual AI threat engine, which I find to be a very useful tool, as well as automated API discovery. Additionally, I appreciate the unified multi-cloud management that allows for the management of policies, logs, and analytics across hybrid and multi-cloud environments through a single control plane.
Check Point WAF (formerly CloudGuard WAF) has positively impacted my organization by reducing rule maintenance, leading to less or near-zero false positives, and enabling frictionless DevSecOps alignment. Regarding Check Point WAF (formerly CloudGuard WAF) AI capabilities, it possesses local logging control, PII reduction, log suppression, tenant isolation, and deterministic threat scoring. The granular rule-based access list and auditability are also crucial, as they allow for enforcing strict rule-based access control and maintaining immutable audit logs for all admin actions and support access requests.
Check Point WAF (formerly CloudGuard WAF) AI-driven threat detection and prevention capabilities have helped my organization by providing more precise detection and response. Check Point WAF (formerly CloudGuard WAF) has improved my ability to discover, monitor, and protect APIs by automatically mapping undocumented API endpoints, ingesting OpenAPI specifications, and enforcing strict schema validation to prevent parameter tampering and logic abuse. This is achieved through automated API discovery and protection. In terms of AI, it evaluates requests against learned behavioral baselines rather than static RegEx signatures, effectively stopping zero-day exploits while drastically minimizing false positives.
What needs improvement?
There should be more tutorials and documentation about the usage of Check Point WAF (formerly CloudGuard WAF) online so more users and tenants can use these security services daily, as it is not as well-documented as other tools, such as the F5 WAF.
For how long have I used the solution?
I have been using Check Point WAF (formerly CloudGuard WAF) for three years.
What do I think about the stability of the solution?
Check Point WAF (formerly CloudGuard WAF) is stable.
What do I think about the scalability of the solution?
Check Point WAF (formerly CloudGuard WAF) scalability is impressive as it prevents the bottleneck common in traditional centralized WAF appliances and ensures the security throughput grows proportionally alongside application workloads. I do not see any bottlenecks, as it scales through a stateless micro-agent architecture that decouples traffic handling from control plane management.
Which solution did I use previously and why did I switch?
I purchased Check Point WAF (formerly CloudGuard WAF) through the AWS Marketplace.
How was the initial setup?
The deployment and ongoing management of Check Point WAF (formerly CloudGuard WAF) were easy.
What was our ROI?
I have not seen a return on investment, as I still have the same number of employees and the same amount of effort and time in hours.
What's my experience with pricing, setup cost, and licensing?
My experience with pricing, setup cost, and licensing for Check Point WAF (formerly CloudGuard WAF) is that it is a bit expensive.
What other advice do I have?
Nothing would make Check Point WAF (formerly CloudGuard WAF) closer to a 10 for me since a 10 would mean preventing against all attacks, which is why it cannot receive that rating; nothing can prevent every attack.
I would advise others looking into using Check Point WAF (formerly CloudGuard WAF) to take an evaluation license and try it first to understand how it works, and then try it again to form a final opinion about whether they are going to purchase it. This way, they can see if it fits within their current setup. I would rate this product an 8 out of 10.
Which deployment model are you using for this solution?
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Powerful Security, But Difficult to Budget
Powerful WAF, but complex setup and reporting need simplification
Its integration capabilities are another plus, especially when connecting the WAF to existing cloud environments and established security workflows. Performance has been reliable as well, providing solid protection without a noticeable impact on application responsiveness. From an ROI standpoint, centralized security management and the reduced effort needed for ongoing monitoring and policy administration make it a worthwhile investment for organizations that require consistent web application protection.
Onboarding and support have also been helpful, particularly when I ’ve had configuration or troubleshooting questions. I also appreciate the intelligence built into the platform, which helps identify suspicious activity and potential threats more efficiently than relying entirely on manual analysis. Overall, it strikes a strong balance between security, usability, performance, and operational efficiency.
Pricing can also be a factor for smaller organizations, particularly when additional capabilities or higher levels of protection are needed. Reporting and analytics could be more intuitive as well; clearer insights and more streamlined dashboards would help users identify trends faster and prioritize security events more effectively. Overall, the product is powerful, but simplifying advanced workflows and making the platform feel more transparent and accessible would significantly improve the user experience.
From my perspective, one of the biggest advantages is the reduction in manual effort needed to monitor and respond to web application security issues. Centralized visibility and policy management make it easier for our security and IT teams to work together, investigate incidents, and maintain consistent protection across our environments.
At the organizational level, it also helps lower security risk, improve operational efficiency, and support broader security and compliance requirements. Rather than relying on multiple disconnected tools and manual processes, we can take a more structured approach to protecting our applications. This enables our teams to spend more time on strategic security initiatives, while still maintaining a strong level of protection for critical business services.
Strong Security, Centralized Visibility, and Seamless Check Point Ecosystem Integration
Strong Security with Ease of Management
Secure filtering and application control have protected web workloads and simplified deployment
What is our primary use case?
I have found features like Cisco ASA and Firepower most valuable. Secure Firewall is a secure firewall with features like WAF and web applications. We have web filtering applications, secure features, and application controls among other features.
What is most valuable?
I have found features like Cisco ASA and Firepower most valuable. Secure Firewall is a secure firewall with features like WAF and web applications. We have web filtering applications, secure features, and application controls among other features. I am not using Cisco SecureX with Secure Firewall.
What needs improvement?
Currently, I have no suggestions for Cisco Secure Firewall. I am not working on the next-generation firewall of Cisco. As I already mentioned, I have no suggestions regarding the features and improvements. I am not working on Cisco firewall currently.
For how long have I used the solution?
Overall, I have been working with Cisco Secure Firewall for almost three to four years.
How are customer service and support?
I would rate the technical support by Cisco a nine out of ten.
How was the initial setup?
I think the implementation is easy. GUI-based implementation for firewalls is straightforward. Although the command line is a very simple process, next-generation firewalls now come with GUI-based interfaces.
What's my experience with pricing, setup cost, and licensing?
In comparison to other vendors, the pricing is reasonable and affordable.
Which other solutions did I evaluate?
I am currently using some Cisco products. I am currently using some switches of Cisco. I am working on the ASA series. I stopped working with Cisco Firewall more than one to two years ago. I am currently dealing mostly with other Cisco products. I am not dealing with Cisco Secure Access or Cisco Duo. I am working with different product vendors such as Check Point and Fortinet. I am working with Check Point Web Application Firewalls and using bundles with them. I am using some features such as WAF and UTP bundles with application controls, web filtering, email filtering, and DNS filtering and controls that are implemented with UTP enterprise bundles and other WAF applications. I have been dealing with Check Point for three to four years on different products. I am using other platforms and testing some things for the networks. I am also using some other products with them.
What other advice do I have?
I did not have new features or functionalities that I have used recently in Secure Firewall. Check Point WAF is used in my company and my customers are using it. I have seen measurable business and security outcomes since implementation of Check Point WAF (formerly CloudGuard WAF). All vendors design firewalls with application filtering. As per current incident reporting, we implement and update our feature updates and security databases. These databases are updated regularly. Check Point WAF (formerly CloudGuard WAF) works fine for every product like Cisco, Check Point, Fortinet, and Palo Alto. I am currently not using Check Point WAF as a primary solution, just for a specific purpose. Check Point WAF (formerly CloudGuard WAF) is working fine and reports, detects, and stops attacks such as IPS and detection. I would rate Check Point WAF (formerly CloudGuard WAF) a nine out of ten. The existing features are working fine, but new day-to-day attacks and issues arise in the environment globally, dealing with attacks such as phishing and DDoS attacks daily. Check Point WAF (formerly CloudGuard WAF) could improve by addressing the new day-to-day attacks and issues that arise in the environment and globally dealing with attacks. I have been satisfied with pricing, technical support, and performance. I am a customer of Check Point. I have been working in this field for several years. My overall review rating for this product is ten.
Application security has reduced incidents and now needs UI fixes and shared exception rules
What is our primary use case?
We have implemented Check Point WAF (formerly CloudGuard WAF) in our environment. We have been dealing with Check Point WAF (formerly CloudGuard WAF) for three months. We are using Check Point WAF (formerly CloudGuard WAF) for our company only.
Currently, we are handling only the L7 part with Check Point WAF (formerly CloudGuard WAF), and we are planning to expand to the APIs and rate-limiting capabilities. We are not handling the network part, as we are only taking care of the security part with Check Point WAF (formerly CloudGuard WAF).
We have a team of 15 people who handle Check Point WAF (formerly CloudGuard WAF) and other security aspects. We have only two administrators dedicated to Check Point WAF (formerly CloudGuard WAF).
What is most valuable?
We have seen measurable business and security outcomes since implementation. We have observed reduced incidents with Check Point WAF (formerly CloudGuard WAF).
Check Point WAF (formerly CloudGuard WAF) has helped us reduce our false positives rate. Compared to other WAF solutions, Check Point WAF (formerly CloudGuard WAF) is user-friendly and very visible. When we review incidents with Check Point WAF (formerly CloudGuard WAF), it is clearly visible where the block occurred and it shows us detailed overview of the incident. In other products, I am not able to get the exact reason for the block, so I can identify where the block happened, and it is very user-friendly for me to add the policy or explicit policy there.
What needs improvement?
I face issues with the UI part of Check Point WAF (formerly CloudGuard WAF), as it malfunctions sometimes. Sometimes I do not see the icons in Check Point WAF (formerly CloudGuard WAF), and whenever I refresh the page, the icons remain invisible.
Additional features I have considered with Check Point WAF (formerly CloudGuard WAF) include the ability to add an exception rule. Since we have multiple projects, I want to add an exception rule to all projects as a shared exception, but when adding it, I am unable to add it individually.
For how long have I used the solution?
I have been working in this field for three years.
How are customer service and support?
When I raise any TAC ticket for Check Point WAF (formerly CloudGuard WAF), I am satisfied with their points and their support, as I am receiving immediate responses from the TAC. I can easily rate their support for Check Point WAF (formerly CloudGuard WAF) an eight out of ten.
An incident occurred regarding the Global Accelerator movement from CloudFront to Global Accelerator, and for that, it took one week to respond, which was delayed by five days.
Which solution did I use previously and why did I switch?
We considered the F5 WAF, Edge, and Radware before finally choosing Check Point WAF (formerly CloudGuard WAF).
How was the initial setup?
Compared to others, it was very easy for us to onboard Check Point WAF (formerly CloudGuard WAF) application.
What about the implementation team?
We received nice support from the OEM for Check Point WAF (formerly CloudGuard WAF), so they guided us, and we completed it within a week, onboarding one full project.
What other advice do I have?
The main reason why I chose Check Point WAF (formerly CloudGuard WAF) is about the cost, and we have a Check Point firewall and we also use endpoint security and email security, so we wanted to choose this as a one-stop solution.
I do not have an idea regarding Check Point WAF (formerly CloudGuard WAF)'s ability for preemptively blocking zero-day attacks and detecting hidden anomalies, as it has been only three months, so we are yet to explore things in Check Point WAF (formerly CloudGuard WAF). Currently, we did not check the AI-driven threat detection and prevention capabilities in Check Point WAF (formerly CloudGuard WAF). Are you referring to the Gen AI or the built-in part of the WAF?
Regarding the built-in AI-driven threat detection and prevention capabilities, I do not see any false positive detection based on the AI part in Check Point WAF (formerly CloudGuard WAF), so everything we are receiving is accurate results only. Based on that learning part, when Check Point WAF (formerly CloudGuard WAF) is in learning mode, the learning part is very helpful for us to filter those things, so after moving it to blocking, we are not receiving any false positive alerts or incidents. If I want to add an exception in Check Point WAF (formerly CloudGuard WAF), I can either add it in the shared one or in a local one.
I have given this review an overall rating of 7.5 out of 10.