Check Point WAF (formerly CloudGuard WAF) Reviews

Our main use case for Check Point CloudGuard WAF is to protect web applications and APIs from common threats such as SQL injection, cross-site scripting, and bot attacks.

A specific example of how we've used Check Point CloudGuard WAF to protect against SQL injection attempts is that we had a public-facing customer portal hosted on AWS, where CloudGuard WAF detected and logged multiple SQL injection attempts targeting the login page and flagged the attacks in real time. We were able to review detailed logs showing the malicious payload, which ensured the application stayed fully available without any downtime and prevented the exposure of sensitive data, giving our security team confidence that the WAF rules were working efficiently against the OWASP Top 10 threats.

Check Point CloudGuard WAF has positively impacted our organization in security and operational efficiency. Our critical web apps and APIs are now continuously protected against the OWASP Top 10 threats, and we have seen fewer phishing exploit attempts after deploying, with a 30-40% drop in malicious traffic and a 15-20% reduction in manual intervention for our SOC team due to reduced false positives and automated protection.

By blocking attacks automatically at the WAF layer, we have reduced the incidents escalated to our SOC team by around 30-35%, and the application team no longer needs to push urgent code changes to mitigate vulnerabilities. The WAF policies buy them time, saving several hours per incident, and with fewer false positives and reduced noise, we have avoided the need to hire additional headcount for web app monitoring.

Some of the standout features of Check Point CloudGuard WAF that help with our main use case are contextual machine learning-based WAF, including the OWASP Top 10 API-based protection and discovery, anti-bot protection, intrusion prevention and CVE coverage, file security, DDoS and rate limiting.

The contextual machine learning-based protection of Check Point CloudGuard WAF works effectively for most teams because it goes beyond the static signature and regex-based detection that traditional WAFs rely on. Compared to older WAFs, we have noticed clear differences, such as smarter detection of novel attacks thanks to the ML engine and lower false positives, meaning the legitimate traffic isn't blocked as often, and we experience faster onboarding for new apps, allowing us to spend less time tuning the policies.

Areas where Check Point CloudGuard WAF can improve include simple policy tuning, as the protection seems strong, though initial rule tuning can be complex. More guided workflows or templates would help speed up deployment, along with deeper integration with the DevOps pipeline, and while it handles API well, more dedicated API security would add value.

In addition, it could be improved with better integration with the DevOps pipeline, more granular reporting, as the dashboards provide good high-level visibility, but sometimes digging into specific attack patterns or trends requires manual effort, and simple tuning of the ML models would be beneficial.

I have been using Check Point CloudGuard WAF for around a year.

Before adopting Check Point CloudGuard WAF, we were using the AWS native WAF for some workloads and Imperva WAF in certain environments, which provided baseline protection but were found too limited in advanced threat protection.

My experience with pricing, setup cost, and licensing is that the pricing and licensing seem fair but not the simplest, as the licensing is flexible and subscription-based. While it can feel complex to estimate the upfront cost depending on traffic volume and features enabled, the initial setup cost is straightforward with minimal infrastructure costs, though fine-tuning and integrating took extra time, which adds to the indirect setup cost in terms of experienced resources.

I did not evaluate other options before choosing Check Point CloudGuard WAF.

I would rate Check Point CloudGuard WAF an 8 out of 10.

I chose the 8 because Check Point CloudGuard WAF provides robust protection, great cloud integration, and effective ML-based threat detection, which has improved our AppSec posture, but it isn't a 9 or 10 yet because the policy tuning can be complex, advanced API protection feels limited, and the learning curve is somewhat steep for new administrators.

My advice for those looking into using Check Point CloudGuard WAF is to plan your deployment strategy early, especially whether to run it in a single cloud or across different environments, as that impacts the setup.

My company has a business relationship with Check Point, as we are a partner.

I was not offered a gift card or incentive for this review.

Check Point WAF (formerly CloudGuard WAF) is required by customers who have web resources and assets that are important to them and in production. These resources include internet shops, services, and financial services. Without a web application firewall, the business stops, and customers need to implement this solution. Insurance companies, banks, and similar organizations fall into this category.

Check Point WAF (formerly CloudGuard WAF) is easy to deploy and provides a complete solution.

Check Point's approach differs from others because it uses artificial intelligence elements and an AI-based approach. The WAF solution operates as a complex solution with multiple functionalities rather than a simple one.

The solution helps reduce the false positive rate. Productivity shows that only 10 to 25 percent will be false positives.

The interface and deployment require qualified skills and a qualified engineer who knows this product very well.

In general, Check Point products load the system somewhat and require more performance and better performance equipment on the customer side.

When compared to solutions specialized only on WAF, such as Imperva or Cloudflare, Check Point WAF (formerly CloudGuard WAF) is a lighter version and does not have as well-performed a load balancer or anti-DDoS option.

We started using Check Point WAF (formerly CloudGuard WAF) two years ago.

Check Point WAF (formerly CloudGuard WAF) scores eight to nine points on a ten-point scale for scalability. This scalability is one of the top features of Check Point solutions in general and especially for Check Point WAF (formerly CloudGuard WAF). It is a main approach of the Check Point team.

I cannot be objective in this question because we have our own service team with engineers on our staff. We handle most tickets and cases ourselves.

We operate as a partner company in projects and serve as an integrator for different solutions, including security solutions.

Regarding total cost of ownership, I cannot describe this accurately. Concerning the price for Check Point WAF (formerly CloudGuard WAF) and license costs, the pricing is good, and the approach could be better.

Regarding competitors, Cloudflare is the most popular and best-selling solution on the Ukrainian market now, and this trend will continue.

Check Point WAF (formerly CloudGuard WAF) and more Check Point solutions are oriented toward cloud infrastructure, cloud, or hybrid infrastructure. I would give Check Point WAF (formerly CloudGuard WAF) an overall rating of nine points.

I have been using Check Point WAF (formerly CloudGuard WAF) on a public cloud.

The features of Check Point WAF (formerly CloudGuard WAF) relate to addressing global attacks that we require. The threat map, which displays information on a live basis, helps us understand the types of points logs, and that is the best part.

I utilize Check Point WAF (formerly CloudGuard WAF) alongside other Check Point products. They integrate with internal systems-level security devices, which we are using to communicate internally. The integration makes the tools work better and is helping us significantly.

Beyond user-level benefits, we are receiving some advantages that are really helping us. Check Point WAF (formerly CloudGuard WAF) did reduce my total cost of ownership for my web application firewall, though not by a substantial amount, but it is acceptable.

In my opinion, there is some room for improvement regarding pricing, which we require, and much of it relates to the license base and support.

I have been using it for more than two to three years, and I confirm that I am currently running on it.

Regarding my experience with the deployment, sometimes we encounter difficulties, but overall it is good, and we achieve our time-based objectives. I would rate the stability as eight to nine.

I rate the technical support from one to ten as eight to nine.

I did not work with other WAFs before Check Point WAF (formerly CloudGuard WAF).

The initial setup is simplified, and I confirm that it is good for understanding.

As of now, I have not integrated with third-party solutions because it is not required.

The investment regarding return on investment is not yet realized, but we are considering that investment base.

The pricing is reasonable, and I believe it is acceptable. I am satisfied with the timing.

Check Point WAF (formerly CloudGuard WAF) is the best option on the market, and it is good for us. The potential attack surface level involves asking about vulnerabilities across the networks, which is why we confirm that it is really helping us.

I find Check Point WAF (formerly CloudGuard WAF) to be good, though I cannot say it is popular in my region.

I would recommend Check Point WAF (formerly CloudGuard WAF) to others, but it depends on the environment. I think it is currently suitable for any types of companies, specifically in the database, which we require.

I confirm that I do not require additional features for Check Point WAF (formerly CloudGuard WAF), and it is currently adequate. I rate this product nine out of ten overall.

I am using not only Fortinet, but I am also dealing with other vendors as well, such as Check Point. I am working with email security by Check Point. I have a little bit of experience with Check Point CloudGuard WAF, as we ran a proof of concept here.

The efficiency improvements provided by Check Point CloudGuard WAF are something I can describe. It was fairly easy to set up Check Point CloudGuard WAF if you are looking at the basic configuration. It was pretty acceptable with setting up rules, and so forth. If you were looking for advanced configurations, then you had to go for a different setup, and that made it a little bit complicated.

In terms of efficiency, Check Point CloudGuard WAF is very straightforward to set up rules because you really do not need to do much customization, as it is the case with all Cloud WAFs.

I have been familiar with Check Point CloudGuard WAF for about six months.

Check Point could improve or add more flexibility when it comes to migrating to different sites. Multi-tenancy is an area where Check Point has room for improvement.

From what I saw, the customer support by Check Point was pretty good, but they were trying to sell it to us, so I would rate it eight out of ten.

Positive

I have experience with FortiWeb, although we just stopped using them. We used to have FortiWeb for the last few years, but now we have actually stopped using them.

The price of Check Point CloudGuard WAF is not expensive, as it was the cheapest solution we found. There is good competition for Check Point CloudGuard WAF at the moment, with big players in the market.

If we selected Check Point CloudGuard WAF, which we did not, it would certainly be much cheaper. I would recommend Check Point CloudGuard WAF to others at a rating of seven out of ten. I would recommend it if you have a simple setup, then it is cheaper and it does the job. My overall review rating for Check Point CloudGuard WAF is seven out of ten.

We have been looking for a solution to protect most of our web applications, especially because we have a couple of them available on the Internet. 

We are not looking at just the web application but also APIs because as a Telco company, we have a mobile money service and some other services that are API-based. We needed a solution that does not only look at our web applications but also our APIs. When I found out about CloudGuard WAF, it was a perfect match. It could not only protect our web application, but we were also able to protect our APIs. We have a couple of APIs on the Internet.

CloudGuard WAF has been great. We had no visibility when it came to our web application because, back then, we only had the next-generation firewall. We were able to protect some network-level attacks, but we had no visibility into what was happening at the application level. What we see now is unbelievable. We are talking about 800,000 attacks that we could not prevent before or were not even aware of, whereas now, we get them every day, and it is CloudGuard WAF that protects us against most of them.

CloudGuard WAF has reduced our false positive rate. That was one of the advantages of the solution itself. False positives are one of the main issues that we have with most security solutions, especially because each application has its own way of working. If the solution is not being able to learn how your applications work, there are going to be a lot of serious issues. With CloudGuard WAF, we did not have much of this issue. We never had an issue where something stopped working because of CloudGuard WAF. Whatever was prevented was actually malicious, so we have a very low rate of false positives. 

CloudGuard WAF is a very straightforward solution. I do not have to worry about signatures. Most of the solutions that are out there are mainly based on signatures, and I have to do a lot of maintenance to get the signature updates, and sometimes, due to a lack of resources, I am not able to do so. With CloudGuard WAF, I have peace of mind, because most of the features are AI-based, and there is not much configuration that needs to be done on my side. Once set, I only go to CloudGuard WAF to check. I do not have to worry about signatures or updates. Everything is done perfectly, and I have a sense of peace because I know our applications are safe. 

It is very important for us that CloudGuard WAF protects our applications against threats without relying on signatures. That is definitely one of the key features I need.

We are satisfied with the product because it does what we need it to do, but one thing that I would like to see improved in the product is the protection of our mobile applications. When I migrate the traffic from our mobile application to CloudGuard, we are not getting what we expected. We would like to be able to also look at our mobile applications.

I have been using Check Point CloudGuard WAF for three years.

It is very stable. We run some of the agents on our data centers and never had any issues. We are happy with the solution.

It is completely scalable.

Technical support is very nice. I have encountered a couple of issues related to the solution. They were not actual issues but things that needed clarification, and support was always there. They gave me the right reference to solve the issues that I faced. I do not have any complaints about the support and customer service aspects.

I would rate them an eight out of ten. They have very short working hours. Especially on the weekends, when you call them, the team is not working because they are a very small team. They need to increase the number of people for 24/7 support.

Positive

We were using Check Point's next-generation firewall. We are heavily Check Point customers.

When it comes to monitoring the solution, I do not have to worry that much about the solution itself. We have the peace of mind that the solution is doing what is expected from us. We do not have to worry much about the solution itself.

It is doing what it is supposed to do, and I do not need people to look at it 24/7. Most of the operations happen in the background, so I do not spend much time on it.

As Infiniti customers, the pricing is manageable, as we have allowances dedicated to each Check Point product. The price is not as high compared to other options I have dealt with in the past. 

Regarding the reduction of the overall total cost of ownership, I am not deeply involved with cost management. However, feedback from a senior manager indicates that we have made a positive decision.

When we were choosing the solution, we had a couple of vendors. After assessing the advantages of each solution, we found Check Point CloudGuard WAF to be the perfect match for my needs.

First of all, there are no signatures. We do not have to rely on signature updates. That was the main reason. Also, it does not only focus on our web application; it also focuses on our APIs. We have got a couple of them.

We, as a company, focus on consolidation. Instead of having siloed solutions separately where people have to look at different solutions, we focus on consolidation. Being able to have another solution that is consolidated and integrated with the other ones we had was a perfect match for us.

I would rate Check Point CloudGuard WAF a nine out of ten.

My use cases include the use of WAF, landing pages, etc.

We see the advantages of a WAF solution when there’s silence, when there are no attacks, no mess, no fails. This is his biggest advantage and how it benefits my company.

Overall, it's a good product. I also have f5 for internal things that I use in another area. We work with several products. I’ve been working with a lot of Check Point’s products for a while, so choosing CloudGuard WAF wasn’t a big decision for me. 

It's a significant advantage that it's not signature-based; it's not too important to me, but it's good that it's that way.

Its ability to preemptively block zero-day attacks and detect hidden anomalies is the advantage of the product. It knows how to protect against any behavior and saves you from messing with signatures; that's its advantage.

There are no false positives in WAF for the most part. If there is an attack, then you know it, and there is mitigation for it. I wouldn’t say the reduction is noticeable.

The assimilation is fast overall. As long as I don't have unique problems that I need support for, usually when WAF works, it works. It's not something you manipulate, it's not an antivirus where you deal with signatures, updates, and upgrades every day. If it works, it works.

I have been using the solution for five months.

It is a very simple product, it’s very stable.

It has great scalability. I see the involvement of Check Point’s team whenever I want to scale. If I need to scale, I open a Whatsapp group with the director and the team, and we quickly proceed to do so.

I get the delivery I want from Check Point, I am a big enough customer to get the best delivery. I also received full technical support, especially during the implementation.

I would rate them a ten out of ten. They are always quick to respond to me.

Positive

The setup was relatively easy; it's a product that is easy to deploy, and there were no big drawbacks. During the installation, we tested it on two apps first; we saw that it worked as it should, and then we moved on to the other apps. The process itself is not long at all. We have another WAF system that we use in other areas so we were aware of how to run these sorts of solutions.

I work directly with the manufacturer; in this case I worked with someone from Check Point itself.

The ROI is that we are not attacked and are confidently protected. When we are attacked, we can understand how important the solution is. We have to get the blow to understand the importance of the solution.

It didn't lower the TCO, it actually raised it, in my opinion. It is more expensive than f5, where we purchased everything as bundles, and Check Point costs more, but it is worth the money.

Check Point is cheaper than Radware. It is relatively cheaper for a WAF solution which is something that we liked and made us choose it. It is a bit difficult to know the price differences since everything is always included in a bundle.

We also looked at Radware, but in the end, we chose this solution because it is very simple to use, and it gave us a much simpler and friendlier interface.

My advice would be to check the use cases you need to see if CloudGuard suits you. I recommend the solution in general.

I would rate it a nine out of ten. I can’t give it a 10 because there’s always room for improvement. I’d say that there should be better support from the integration team, I’m not sure if it’s Check Point’s responsibility, though. Overall, the product is excellent.

My use case is mainly for new products that come up in the marketing field, products that are fast and need quick assimilation.

We connected protections, mainly of the WAF for products that do not need too much scam validation or more complex functions. The aim was to provide a quick response to marketing campaigns, customer transportation, and things that need very fast implementation.

Check Point CloudGuard WAF has helped our organization in time-to-market manners; the time to market is very short. Unlike other products we tested, which were a bit more complex, they would take a day's process. Check Point CloudGuard WAF only takes a few minutes of assimilation and then goes live.

Its ability to protect our applications against threats without relying on signatures is one of the benefits I liked about this product. It does not depend on signatures. It looks at the anomaly in behavior. This is what we call a modern application. It saves us the headache of these updates and also the fact that the zero day usually has no signature.

The ability to preemptively block zero day attacks and detect hidden anomalies is exactly its advantage. The zero day does not wait for a signature but looks at behavior. This is how a modern app should be. If you wait for the unknown, your application will be affected, but with this solution, even if you don't know where the attack could come from, the product protects it because of the behavior. That's the advantage.

The assimilation time is short, about a few minutes only, so it is very simple for us and shortens the time of our functions. I'd say it has lowered 30% of our time.

In a product like this, there are not many false positive cases, at least not in our type of implementations, which are not complex. When you do not hear about any false positives, it is a sign that the solution is doing its job.

This product is very simple, it does not require complexity in its implementation. Its ability to deploy our materials quickly is what we appreciate the most.

I would like it to be able to analyze more complex functions, although I did not examine the case study of more complex implementations. Things like forum fields, etc seem to need a little more focused protection of the fields scheme validation. I would say that the more automation this product has, the easier it will be to work with it.

I have been using Check Point CloudGuard WAF for six months.

There were never any server issues, they're very stable.

I am not really sure about its scalability since our framework is very limited at the moment. I am guessing that after we try to deepen our use cases, we may scale then.

Check Point is known for providing really good service. If a ticket is opened, it is addressed and not neglected. The emphasis is on the Israeli team, which knows how to achieve escalations and provide a response. We were never left without an answer.

Positive

We have had several protections from other WAF products that we have tested. Their implementations were longer, more complex, and sometimes, because of the speed we would implement it after it went live because of the times. The time to market was short, and we didn't have time to achieve the desired time window.

Today, with Check Point CloudGuard WAF, there is no way we'll go live without protection.

We used and evaluated Radware and Reblaze. They were very expensive and also dependent on third-party services. With Check Point CloudGuard WAF, everything was done easily in-house.

I'm in charge of the regulations, the SECOPS team is the one involved in the deployment. I'm more of a policy guide, and from what I've noticed, the experience was good.

We always have a business partner who accompanies us in projects of this type. We have always had a good experience with them, the're very professional.

The biggest ROI is that the time to market is good; I am not holding back the business. I do not look that much at attack prevention because that's something that every product usually does. The ROI is the time to assimilate and the short time to market. Those are its benefits.

I am less knowledgeable with prices because I only define the requirements and look at the execution. I know that its price is relatively expensive compared to other products but it gives benefits that are worth it.

My advice would be to use this solution since it's cloud-based and the deployment is quick and easy.

Overall, the platform is great. I would consolidate it from the usual infrastructures, though. Every platform requires someone to focus on it, so it would be good if an integrator would be more involved in this specific solution.

I use CloudGuard WAF for our exposed customer-facing servers.

It provides security for our customers and our products.

This solution not require training. It has its own mechanisms, eliminating the need for training for our applications. The learning curve is quick.

It provides security for our services to customers. As a financial institution, we provide security to our customers and products.

The solution preemptively blocks zero-day attacks and detects hidden anomalies effectively.

The solution reduced the cost to the company when considering that we,with a previous solution, spent many hours on configurations.

It reduced our false positive rate significantly - by 90%.

The reporting can be improved. Currently, it is not 100% accurate, however, it is at a good level. I cannot see many logs for our application that are posted under CloudGuard WAF, and sometimes I cannot identify the issues I have with CloudGuard.

I have been using the solution for three years.

The stability is 100%. I did not have any issues in the last three years during which I had more than ten critical services running on CloudGuard.

Customer support is usually needed during the implementation of the solution. After that, I have only opened a case two or three times, and the response time is very good.

Positive

I had the same solution with the same company, however, it was on-premise. I moved to a cloud-based solution with CloudGuard WAF, and it is very different.

When considering my previous solution, I spent many hours on the configuration.

Pricing and licensing are really expensive for this product. While it provides a very good security level, the price for each service is high. Small organizations might not be able to afford the price.

I would rate the solution nine out of ten. Overall, it is a very good solution. 

The primary use case for Check Point CloudGuard WAF is for protecting web applications and APIs. We use it for web apps and APIs we want to protect.

Check Point CloudGuard WAF has improved our organization by providing protection against web application attacks such as SQL injection, cross-site scripting, and bot threats. Its automated threat prevention and real-time traffic analysis reduced manual intervention and response time. Integration with our cloud infrastructure enabled seamless deployment and scalability, while centralized visibility helped enforce consistent security policies across all environments.

The most valuable feature is the AI/ML engine, which does the job for us and mainly reduces the number of false positives and adapts accordingly. It significantly impacts workflow efficiency, allowing us to focus more on other fields. After implementing it, we have better results in vulnerability and penetration testing and scanning.

CloudGuard WAF could improve UI simplicity, reduce false positives, and enhance policy management. Future releases should include better bot mitigation, behavioral anomaly detection, compliance templates, advanced threat intel integration, and streamlined multi-cloud support to boost protection and usability.

I have been using the solution for one year.

Check Point CloudGuard WAF is very stable.

Its scalability is inherent to its SaaS solution.

The customer support is great.

Positive

We did not have any other solution before using Check Point CloudGuard WAF.

The initial setup was positive, and we did not face any problems.

There is potential money-saving regarding some successful attacks if we did not have Check Point CloudGuard WAF.

Our experience with pricing, setup costs, and licensing was positive. We did not have any issues.

Before choosing Check Point CloudGuard WAF, we did not evaluate other options.

I recommend implementing it easily, onboarding services quickly, and utilizing its policy blocking. It is very useful and efficient. I rate Check Point CloudGuard WAF a ten out of ten. The AI/ML engine, which greatly reduces false positives so that we do not have to manage them manually, stands out the most.

I have dealt with a very complex situation. We are fortunate to have a global presence in 98 countries. We have about 400 people working worldwide. 

Our challenge is to support our customers and protect our infrastructure, which is quite different from normal ones. Unlike a typical company that centralizes everything in a data center, we work in countries with strict legal restrictions. This requires us to create a separate infrastructure for each country. I need something to support us and provide compliance.

I am a very exposed company, and this solution helps prevent attacks.

I have thousands of exposed websites and APIs. Being able to control what is happening and try to prevent any attack is the best feature. 

I provide gamification, and if one wants to acquire services like Netflix, they can go through my application. Some people try to find tokens to sell on the black market; however, with the WAF, I'm able to understand what's happening and block it in real-time.

It's important to protect against threats without relying on signatures. If it sees any anomaly, it just blocks it.

Check Point CloudGuard Network Security helps guard against zero-day attacks. Luckily, we haven't had any.

Check Point CloudGuard Network Security helped reduce the cost of ownership for our web application firewall by 50%. We have everything centralized and we can configure everything centrally.

We've been able to reduce our false positive rate by 80%. It's easier to have something automated instead of a person working on this, checking everything. 

I'm not sure what can be improved. I don't manage the solution. It seems to be a product that runs all the time. They might be able to add more integrations. Security could always be improved. Overall, it's very good. 

I have used the solution for the last three years.

I would give stability a nine out of ten for sure. It is very stable. As an evolved product, there are always areas to mature, of course, however, it provides a very good and mature experience.

I enjoy it the scalability. I can scale up or down based on workload, so I'm very fortunate with that.

I have a great partnership with Check Point. I know a lot of people who work there. For me, it's a very positive and beneficial relationship.

Positive

I did not use any previous solutions.

The initial setup was very intuitive. I had minor issues, however, that was due to not reading the documentation properly. Overall, it was a very satisfying and straightforward experience.

I did the implementation by myself, however, I have a partner as well. They can do things first; however, I managed it on my own since it was easy to do.

We have yet to see an ROI.

For me, the pricing and licensing is a fair value for what they provide.

I did not consider alternate solutions. This was included in my subscription. I have a full suite of Check Point products, so I just use this.

I would rate the solution a seven out of ten. I'm not the one managing it. From what I've heard about the challenges we face, I would rate it a seven. In one project, we had to use mutual certificates, and it wasn't the best experience to configure. It is doable, however, it can be improved. This causes some issues for our customers. 

If someone is only using a cloud-native option WAF, they are missing out on agility. We're more agile since we can protect everything we have. And multi-cloud is a real thing. Everyone has multiple clouds, so centralizing everything into one place is the greatest, in my opinion.