Check Point WAF (formerly CloudGuard WAF) Reviews

I use it on our websites and web servers, and it is protecting against malicious code and injection code, as well as any type of attacks.

Check Point CloudGuard WAF enhances web application security with AI-driven threat prevention and seamless cloud integration.

The Check Point WAF gives me a view that I did not have that occurs on the web servers. 

It allows me to show results and reports to demonstrate the attacks, the number of attacks, and prevention measures.

It protects against threats without relying on signatures. The zero-day attacks could be bad. Without this, we wouldn't know al the attacks we're getting. It allows us to save time manually analyzing on the web servers. It frees us up.

It helps against zero-day attacks and protects against anomalies. It's one of the factors that made us choose this solution. 

For now, the product is doing all that I need, however, I need the support of IPv6.

I have used the solution for three months.

It is very stable, never crashing or giving me an error that I can see. It responds very quickly and allows me to enter the menu and set up and configure everything without problems.

The customer service is very good. I have opened one or two cases and received quick responses.

I have not used any other solutions for a while.

The initial setup is very easy. We use it for our on-prem web servers. It only takes five minutes to deploy.

I used an integrator to help with the implementation the first time. They explained the phases, and it was very simple and quick. The person who helped was from Portugal.

I don't have an exact number in terms of ROI.

The setup cost is very simple. It is a really good price considering the functionalities of the product and the price of the license. It is very well-calibrated.

We did not evalute another solution. I'm a Check Point customer. 

If someone is only using a cloud-native product and not using something like CloudGuard, I'd advise buying it. It is a very good product. Now with WAF, I see many attacks being prevented. It is a good solution for me. I have five million requests per month on our web server. The last results I saw showed maybe 50% to 60% of attacks being prevented. 

I rate it ten out of ten. I am very satisfied.

On-premises

We have over ten root domains that we need to protect through the firewall. All our hosts are in EC2 instances, and it is challenging to protect them by using any AWS load balancer or shields. Therefore, we have implemented Check Point CloudGuard WAF as a solution to protect all these domains from the open internet. It supports all environments, including on-premises, Azure, AWS, and we have also implemented it for CDN URLs as well.

It has improved the overall security posture of our organization. Earlier, our security score was around eight to nine, which increased after implementing Check Point CloudGuard WAF. We have achieved NIST compliance, and now ninety-five percent of the environment compliance level is equal to ninety-five percent.

The support of the root domain is one of the best features, as is the support for the CDN and advanced load balancer. These are key features that differentiate Check Point CloudGuard WAF from other vendors. Additionally, rate limiting is another significant feature of the WAF.

The UI interface needs improvement because there are a number of bugs. Integration with the SIEM platform is currently one of the key challenges that need to be addressed.

We have been using Check Point CloudGuard WAF for the last six months.

I think Check Point CloudGuard WAF is stable.

It is a SaaS-based model, and we have not encountered any scalability issues. They have sufficient resources, and there are no challenges from a scalability perspective.

The customer support is good. They have skilled personnel to provide support.

Positive

We did not use a different solution prior to this.

The return on investment is reflected in the improvement of the overall security posture. While it does not have a direct monetary impact, it enhances security with an improved NIST compliance score and better overall security scores for our organization.

Pricing and setup costs are fine. It is less costly than Cloudflare, Fortinet, and other vendors. Additionally, it is less costly than the OEM.

We evaluated Cloudflare and Fortinet.

I would advise others to use and implement Check Point CloudGuard WAF as a solution in the firewall segment. Check Point has been in this segment for two decades and is more stable than other firewall vendors. I recommend using it and implementing all the features it offers. Overall, it's a good solution, and it fulfills all our core purposes, providing complete visibility and security. That's why I rate it ten out of ten.

Public Cloud

Other

My team and I work with Check Point CloudGuard Code Security and handle all related tasks, including deploying virtual machines and configuring all aspects.

Our security team's roles include networking security, and our responsibility is to deploy all firewalls across our organization's sites, both on-premises and in the cloud.

The most valuable features of Check Point CloudGuard Code Security include our approach to manage it via the management we have on-premises, and we also deploy the same extension management of CloudGuard to manage all the virtual systems on Azure.

We effectively use artificial intelligence with Check Point CloudGuard Code Security, as we have teams that work with AI and we frequently manage our firewalls using AI along with the CloudGuard and all virtual systems.

There are still areas for improvement with Check Point CloudGuard Code Security. All the features we have on the firewall on the on-premises side, we also have under CloudGuard such as IPS, Anti-Bot, and all these blades are set up in our CloudGuard.

[Full sentence answer to 'For how long have I used the solution?' from the text.]

The initial setup of Check Point CloudGuard Code Security is very challenging because it requires more preparation, and we need more guides to understand how to set up all aspects.

I would rate the support for Check Point CloudGuard Code Security as good because we can quickly email support about any problems we encounter, and they reply instantly to provide help. I would give it an eight.

Positive

To deploy Check Point CloudGuard Code Security, it requires four people on our team to manage all the Check Point devices.

Some challenges with Check Point CloudGuard Code Security include that we noticed FortiGate is much more efficient on AWS, and our team prefers to deploy FortiGate there instead of CloudGuard due to the management challenges on the cloud.

I do not have experience with CyberArk, we only work with VSX and the family of VSX, which is provided by Check Point.

I can recommend Check Point CloudGuard Code Security to other organizations as it is a good platform to protect our organization. On a scale of one to ten, I rate this solution an eight.

Hybrid Cloud

Microsoft Azure

I am currently evaluating a hybrid solution for our infrastructure since some of our services are hosted on-premises while others are processed through the cloud. We have multiple websites, applications, and some non-web-based applications that we need to protect.

The solution's ability to handle multiple websites and applications without needing more expensive hardware is a key advantage. 

The communication between the on-premises device and the cloud for analysis and feedback is a valuable feature. It also supports legacy applications and improves security access. Upon implementation and evaluation with third-party penetration testing, it meets rigorous security standards required for dealing with financial institutions and provides necessary protection between our central office and peripheries through VPN access. 

The solution allows for proactive support and parts replacement.

The learning curve was a challenge due to initially incorrect configurations. It took approximately a month and a half to understand how the solution works because of inadequate documentation. The provider could improve by providing better guidance and support during the configuration process.

I am happy with their support. They were responsive even before we committed to buying their solution. The support rating is about seven and a half to eight out of ten.

Positive

We looked at FortiGate and some open-source solutions, however, they either did not fully meet our requirements or required a dedicated person for administration, making them cost-prohibitive.

We collaborated with our vendor, A1, which also offers parts replacement and support as part of the package.

The base solution costs approximately 30,000 euros, with an additional 2,000 euros per year for licenses and support.

The price is fair for the features offered. For us, it is cost-effective compared to hiring a dedicated person for administration.

Prior to choosing the current solution, we considered FortiGate and other open-source solutions.

I would rate the solution eight out of ten. 

Hybrid Cloud

Other

Protecting our websites or our customers' websites is our top priority. We transitioned to Check Point WAF from on-premises WAF to safeguard our external perimeter. Essentially, I am focused on protecting our external infrastructure and web services.

It helps me sleep at night, providing peace of mind. It saves time, money, troubleshooting, and maintenance and reduces the need to hire people to manage the technology because it is so easy to use.

The WAF is the best feature. The application firewall's ability to block and recognize all attacks in real-time, such as DDoS, is invaluable. Identifying attacks and integrating with the rest of the ecosystem are features I am very fond of.

It's a pretty robust product.

CloudGuard protects against threats without relying on signatures. This is one of the best features. As an engineer, I don't have to review signatures one by one by one. 90% of the other players use signatures. So you have to review the attack, the signature, and how to mitigate it, etcetera. Removing the signatures from the equation removes a lot of time required for an engineer to review signatures, apply signatures, verify that these are applied to the infrastructure, etcetera. So removing that from the equation and protecting the infrastructure at all times is very cost-effective. 

Signature-based also causes a lot of false positives. So having no signature also helps remove a lot of the false positives. 

I cannot think of any needed features.

Pricing is high, although possibly justified by the service received. Reducing prices would be welcome. 

Integration with more technologies or Check Point products, or on-prem products, could improve robustness. Many organizations are moving to the cloud. Some cannot fully transition and require solutions similar to on-prem devices. 

I have used the solution for the past two years.

Support is the same with on-premise devices, and it is very good. Since it is cloud-based, I do not need them as much. 

Positive

I have used CloudGuard, Imperva Cloud WAF, and Barracuda Cloud WAF. I have experience with all of the major players.

I have seen what we were used to before and how much time we spent. We used to manage on-prem devices for other partners that could run from other vendors. When you migrate to the cloud, it feels like saving 90% of your time.

If the price could come down, I would be very happy with the product.

I will not disclose which vendor is the best. In specific cases, some vendors perform well, while others are competitive at the high end. Check Point is one vendor that I really appreciate, and I will not mention the other, however the competition is very close.

I would rate the solution nine out of ten. Nobody is perfect. 

I have found features like Cisco ASA and Firepower most valuable. Secure Firewall is a secure firewall with features like WAF and web applications. We have web filtering applications, secure features, and application controls among other features.

I have found features like Cisco ASA and Firepower most valuable. Secure Firewall is a secure firewall with features like WAF and web applications. We have web filtering applications, secure features, and application controls among other features. I am not using Cisco SecureX with Secure Firewall.

Currently, I have no suggestions for Cisco Secure Firewall. I am not working on the next-generation firewall of Cisco. As I already mentioned, I have no suggestions regarding the features and improvements. I am not working on Cisco firewall currently.

Overall, I have been working with Cisco Secure Firewall for almost three to four years.

I would rate the technical support by Cisco a nine out of ten.

I think the implementation is easy. GUI-based implementation for firewalls is straightforward. Although the command line is a very simple process, next-generation firewalls now come with GUI-based interfaces.

In comparison to other vendors, the pricing is reasonable and affordable.

I am currently using some Cisco products. I am currently using some switches of Cisco. I am working on the ASA series. I stopped working with Cisco Firewall more than one to two years ago. I am currently dealing mostly with other Cisco products. I am not dealing with Cisco Secure Access or Cisco Duo. I am working with different product vendors such as Check Point and Fortinet. I am working with Check Point Web Application Firewalls and using bundles with them. I am using some features such as WAF and UTP bundles with application controls, web filtering, email filtering, and DNS filtering and controls that are implemented with UTP enterprise bundles and other WAF applications. I have been dealing with Check Point for three to four years on different products. I am using other platforms and testing some things for the networks. I am also using some other products with them.

I did not have new features or functionalities that I have used recently in Secure Firewall. Check Point WAF is used in my company and my customers are using it. I have seen measurable business and security outcomes since implementation of Check Point WAF (formerly CloudGuard WAF). All vendors design firewalls with application filtering. As per current incident reporting, we implement and update our feature updates and security databases. These databases are updated regularly. Check Point WAF (formerly CloudGuard WAF) works fine for every product like Cisco, Check Point, Fortinet, and Palo Alto. I am currently not using Check Point WAF as a primary solution, just for a specific purpose. Check Point WAF (formerly CloudGuard WAF) is working fine and reports, detects, and stops attacks such as IPS and detection. I would rate Check Point WAF (formerly CloudGuard WAF) a nine out of ten. The existing features are working fine, but new day-to-day attacks and issues arise in the environment globally, dealing with attacks such as phishing and DDoS attacks daily. Check Point WAF (formerly CloudGuard WAF) could improve by addressing the new day-to-day attacks and issues that arise in the environment and globally dealing with attacks. I have been satisfied with pricing, technical support, and performance. I am a customer of Check Point. I have been working in this field for several years. My overall review rating for this product is ten.

My main use case for Check Point CloudGuard WAF is to protect web applications and APIs from OWASP Top 10, and it has helped to secure cloud workload and prevent unauthorized access to data leaks.

I use Check Point CloudGuard WAF to block SQL injection and cross-site scripting attacks, and we protect the API by enforcing strict access, automatically applying a security policy to new applications before deploying in the cloud.

The best features Check Point CloudGuard WAF offers in my experience include automated policy upgrade with threat coverage intelligence, flexible deployment, and zero-day protection, which stand out to me the most.

The automated policy creation and threat intelligence have helped my team by reducing manual configuration and saving time, and the threat intelligence updates ensure immediate protection against new threats, simplifying daily operations and improving response speed.

Check Point CloudGuard WAF has positively impacted my organization by strengthening overall application security and data security, and it reduces manual workload for the security team while improving compliance in securing cloud workloads.

It has improved compliance and manual workflows through automated updates and reports, making it easier to meet compliance, with faster audits and readily available security evidence in reports, and it reduces time spent on manual rule creation and log reviews by automating policy enforcement.

Check Point CloudGuard WAF could be improved by simplifying the initial setup for a faster deployment, making the dashboard and reporting more customizable, and offering a more accessible pricing model.

I have been using Check Point CloudGuard WAF for the past one year.

Check Point CloudGuard WAF is definitely stable in my experience.

It has a user-friendly interface that makes monitoring and management easier with smooth integration with other Check Point and third-party security tools, and it provides a clear dashboard for visibility into attack and traffic patterns.

I would rate customer support as eight out of ten.

I chose this rating because sometimes the response will be delayed more than expected.

Customer support is good, but sometimes it takes longer than expected.

Positive

I have seen a return on investment from using Check Point CloudGuard WAF, considering both time and money.

My experience with pricing, setup cost, and licensing was good.

The experience with pricing, setup cost, and licensing is straightforward without any challenges.

My advice for others looking into using Check Point CloudGuard WAF is to plan deployment with clear policies to maximize protection from the start and take advantage of automated updates and threat intelligence to reduce manual work, ensuring proper integration with your cloud environment.

Public Cloud

Amazon Web Services (AWS)

I use the solution for almost all of our web servers.

Before CloudGuard, we periodically had some website issues. Since we've had CloudGuard, we've never had these issues happen again. 

The rate limit feature is the most useful feature of the product.

We don't need to rely on signatures. We are protected when the signature doesn't exist. 

It can protect against zero-day attacks and hidden anomalies. It blocks items that would affect the company.

We've been able to reduce our false positive rate. It took a bit of time, however, not long. We're near zero false positives. 

The web user interface needs some improvement, even though the functionality is good. More user-friendly features could be added. Perhaps something between CloudGuard management and the virtual appliance on-site could be faster. 

It could be interesting to have an app for smartphones to manage all the cloud environments.

I have been using the solution for three years. 

The stability is always good. 

The scalability is always good.

I rate the solution nine out of ten. I am satisfied. It is always good. 

On-premises

My main use case for Check Point CloudGuard WAF is defending from SQL injection or DDoS attacks, and a quick specific example would be that it protects our applications and data from these threats.

I don't have anything else to add about my main use case, as there are no stories or examples where it helped my team.

The best features Check Point CloudGuard WAF offers are that it's very easy to use, the automated management is very nice, and the introduction of new AI is very efficient, which I find valuable.

With the introduction of AI in general, Check Point CloudGuard WAF provides very high accuracy on the data, allowing me to avoid a lot of false positives and saving me time in determining if what I'm seeing is a possible attack.

Check Point CloudGuard WAF has positively impacted my organization by reducing incidents because I don't have false positives.

Check Point CloudGuard WAF can be improved; initially, the setup is very complicated, and there's not a lot of documentation available, plus it didn't have something for anti-bot, but other than that, it is fine.

The documentation issue means that I can't find it online very easily, and while I can always ask support, it's a bit limited. As for anti-bot, I refer to a feature that I can find a better option for on Cloudflare.

I don't have anything more to add about the needed improvements or anything regarding the onboarding.

I have been using Check Point CloudGuard WAF for one year.

Check Point CloudGuard WAF is very stable, and I haven't had any issues with downtime or reliability, plus it handles growth easily in my environment.

The customer support is rated eight. I have had to contact them, and my experience was satisfactory.

I did not previously use a different solution before Check Point CloudGuard WAF, so there's no prior comparison.

I don't have metrics, but I see a return on investment in overall efficiency, as it has saved my team time and reduced incidents.

I don't know about the pricing, setup cost, or licensing for Check Point CloudGuard WAF, as I don't manage costs.

Before choosing Check Point CloudGuard WAF, I did not evaluate other options, as I went straight with it.

Check Point CloudGuard WAF works very well with all the clouds, such as Azure and AWS, and I shouldn't have any problems adding this feature to my environment.

Regarding the reduction in incidents, I don't have any percentages, but I know I can save a lot of time because I understand that if something is signaled, I need to check it, as it's very not probable that it is a false threat.

My advice for others looking into using Check Point CloudGuard WAF is that, similar to other Check Point services, it can be intimidating at the start, but you will manage after some time.

I rate Check Point CloudGuard WAF eight out of ten.

Hybrid Cloud

Microsoft Azure

Due to the nature of our business, we have heavily invested in backend API development, providing services exclusively through this interface. Similar to how banks and medical industries utilize data from centralized sources, our APIs cannot be exposed directly to the Internet. To safeguard these critical APIs, a robust security solution is essential. 

Check Point CloudGuard WAF fulfills this need by intercepting all incoming internet traffic, categorizing requests as legitimate or malicious, including attack details, and blocking suspicious activity at the initial stage. Only verified, non-malicious requests are permitted to interact with our APIs.

When we activate the WAF, our security signatures and all the latest threat intelligence are immediately updated. Our protection is automatically refreshed every few hours to address emerging threats. For example, if a zero-day attack originates in Europe, Check Point CloudGuard can detect it within minutes and distribute a new signature globally. This ensures that when the attack reaches Australia, it is already blocked by our up-to-date WAF.

Although the WAF still produces false positives because of the signatures, we can apply a rule to exclude them easily.

Automated threat intelligence is crucial because a ransomware attack can compromise a network in minutes. Imagine an attack occurring at 3 AM when staff is unavailable; the damage may already be done when someone investigates. Ransomware can infiltrate and complete its task within just a few sessions. Once inside, attackers can lay dormant for months, covertly sending data using internal IP addresses. These addresses are often whitelisted, making it difficult to detect whether the outbound traffic is authorized or malicious. Automated threat intelligence can rapidly detect and respond to attacks, unlike manual processes that take 15 to 20 minutes, often too late to prevent significant damage like a completed ransomware attack. Systems like OCSP, utilizing best practices from multiple vendors such as Azure, Microsoft, CheckPoint, Palo Alto, and CloudStrike, provide an open platform for sharing and updating threat signatures. This enables organizations to tailor their security measures based on specific application needs and behaviors, effectively mitigating risks without unnecessary restrictions.

Cloud-based WAF solutions, such as Check Point's, offer significant advantages compared to traditional on-premises WAFs like Cisco or Palo Alto. On-premises WAFs require substantial upfront costs for hardware, expensive licenses, and frequent, costly upgrades as technology evolves. Cloud-based alternatives eliminate these expenses by providing the latest features and capabilities without hardware or software management. This flexibility and cost-efficiency make cloud WAFs appealing to many organizations. However, cloud solutions can be more expensive for high-throughput applications like Instagram or Facebook due to data transfer costs. At the same time,  on-premises options might be more economical in these cases. Ultimately, the best choice depends on specific network size, criticality, and application requirements.

Machine learning is a valuable tool for this assessment because it allows for a two-phase approach: secure and non-secure. In the first secure phase, pre-built signatures are used, eliminating the need for a live tracker as the necessary data is readily available. This approach efficiently blocks threats without progressing to the slower, resource-intensive second phase. Unlike competitors who process every request, this method conserves CPU power and prevents application slowdowns.

Check Point CloudGuard WAF's code could be improved. While the GUI allows configuration for application-related features, specific definitions cannot be modified through the code. Ideally, we would prefer consistent configuration across all products to simplify deployment, but in this case, the ISE is incompatible with the two or three different models we've identified. Therefore, we must rely solely on the GUI for configuration.

I have used Check Point CloudGuard WAF for four months.

It was stable in the four months we ran Check Point CloudGuard WAF.

I would rate the stability nine out of ten.

I would rate the scalability nine out of ten. We only reached 80 percent of our CPU capacity.

The technical support is good. We didn't use them much, demonstrating the product's quality.

Positive

At that stage, our primary goal was to select a suitable WAF to replace our existing F5 WAF. While the F5 WAF performed well, we sought to eliminate it due to excessive licensing costs. Given the high expense of our entire WAF solution, we explored alternatives, including Azure WAF, Check Point WAF, and Palo Alto WAF. Although we initially considered Cisco WAF, it was quickly discarded as outdated. After a two-week evaluation, we narrowed our options to Azure, Check Point, and Palo Alto WAFs.

The deployment is straightforward and similar to any standard firewall installation. While the process took four days due to design finalization, deploying directly from code can be completed in less than thirty minutes.

Two people were involved in the deployment, one working on the design and the other on the ISE.

Check Point CloudGuard WAF is expensive compared to Azure WAF. I would rate the cost of Check Point CloudGuard WAF as eight out of ten, with ten being the most costly.

We evaluated Cisco WAF, but it is outdated and no longer competitive. Since we utilize Azure Cloud, we opted for Azure WAF due to our preference for cloud-based solutions. Azure WAF has performed well and is seamlessly integrated behind the scenes. We also evaluated Palo Alto, but configuration challenges through ISE led us to discontinue its use seven months ago. Check Point CloudGuard WAF was abandoned for similar reasons. Azure WAF's integration with ISE, including built-in Bicep modules for CLI configuration and deployment, is a significant advantage. Currently, we manage approximately 35 IP addresses and require two distinct stages for WAF settings and module deployment. Consistent signature stem definition across different environments is essential. ISE was crucial in our decision-making process, ultimately replacing Check Point due to the latter's lack of ISE integration, a critical requirement. While Check Point offered several strengths, the absence of ISE was a deal-breaker. Overall, Azure WAF has met our expectations.

I would rate Check Point CloudGuard WAF eight out of ten.

We have six environments in multiple locations and eight products that use 20 APIs.

We have a team of four working with the WAF.

I would recommend Check Point CloudGuard WAF if it fully meets the organization's needs, the cost is reasonable, and they desire AI and ML integration in the future. However, since we do not require AI or ML and prioritize ISE for our management approach, this solution did not align with our requirements.

Public Cloud

Microsoft Azure