No more typing reviews! Try our Samantha, our new voice AI agent.

AWS WAF vs Atomic ModSecurity Rules comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Atomic ModSecurity Rules
Ranking in Web Application Firewall (WAF)
29th
Average Rating
9.0
Reviews Sentiment
7.8
Number of Reviews
1
Ranking in other categories
No ranking in other categories
AWS WAF
Ranking in Web Application Firewall (WAF)
8th
Average Rating
8.0
Reviews Sentiment
6.8
Number of Reviews
63
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of September 2026, in the Web Application Firewall (WAF) category, the mindshare of Atomic ModSecurity Rules is 0.8%, down from 1.0% compared to the previous year. The mindshare of AWS WAF is 3.9%, down from 6.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Web Application Firewall (WAF) Mindshare Distribution
ProductMindshare (%)
AWS WAF3.9%
Atomic ModSecurity Rules0.8%
Other95.3%
Web Application Firewall (WAF)
 

Featured Reviews

Vahid Babaey - PeerSpot reviewer
PhD Student at University of North Carolina at Charlott
Open rules have enabled me to secure web apps against obfuscated SQL injection and XSS attacks
The best feature Atomic ModSecurity Rules offers is the open source aspect. I believe that because it's open source, all of the developers, programmers, and security experts are able to update this WAF and provide more rules, creating a more secure WAF for all of the clients and customers around the world. By accessing Atomic ModSecurity Rules, it has helped me significantly. Because of this open source feature, I am able to generate new rules and update the WAF and use this WAF in my research and also give it to other clients and customers to use the updated WAF. All of this is done just because of the open-source feature, because it can be updated.
Azam S M - PeerSpot reviewer
Infrastructure Lead at Danat Fz LLC
Has successfully filtered malicious traffic and allowed country-specific access controls
For improvement in AWS WAF, we can have better monitoring. One of the things that should be improved in AWS WAF is the monitoring; we need to identify the requests and where they are coming from. If it's a bot, we should differentiate the requests, whether they are automated or not. The way we see it now is just mentioned as a percentage from bots and actual users, which should include proper graphs and detailed information. We also need a feature where we can filter specific requests. If there are scripts in the requests, we should be able to filter those requests to see if there are any scripts running from them.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The best feature Atomic ModSecurity Rules offers is the open source aspect, because all of the developers, programmers, and security experts are able to update this WAF and provide more rules, creating a more secure WAF for all of the clients and customers around the world."
"We have received good support from the customer service and support team."
"The solution's initial setup process is easy."
"AWS WAF has a lot of integrated features and services. For example, there are security services that can be integrated very well for our customers."
"The tool’s stability is very good."
"The interface is good."
"Overall, this is a good product and I recommend it."
"The automation of blocking for security attacks is valuable, with AWS applying rate limiting."
"The initial setup is easy."
 

Cons

"Additionally, I know that ModSecurity can block only SQL injection and XSS attacks, no more types of attacks."
"The serverless product from AWS WAF could be improved. For example, they have only one serverless series, Lambda, but they should extend and improve it. Additionally, the firewall rules are not very easy to configure."
"The solution can improve its price."
"The solution is cloud-based, and therefore the billing model that comes with it could be more intuitive, in my opinion. It's very easy to not fully understand how you tag things for billing and then you can quite easily run up a high bill without realizing it. The solution needs to be more intuitive around the tagging system, which enables the billing. Right now, I have a cloud architect that does that on our behalf and it isn't something that a business user could use because it still requires quite a lot of technical knowledge to do effectively."
"The product could be improved by expanding the weightage units of rules we have when writing policy."
"They have to do more to improve, to innovate more features. They need to increase the security. It has to be more active in detecting threats."
"It is sometimes a lot of work going through the rules and making sure you have everything covered for a use case. It is just the way rules are set and maintained in this solution. Some UI changes will probably be helpful. It is not easy to find the documentation of new features. Documentation not being updated is a common problem with all services, including this one. You have different versions of the console, and the options shown in the documentation are not there. For a new feature, there is probably an announcement about being released, but when it comes out, there is no actual documentation about how to use it. This makes you either go to technical support or community, which probably doesn't have an idea either. The documentation on the cloud should be the latest one. Finding information about a specific event can be a bit challenging. For this solution, not much documentation is available in the community. It could be because it is a new tool. Whenever there is an issue, it is just not that simple to resolve, especially if you don't have premium support. You have pretty much nowhere to look around, and you just need to poke around to try and make it work right."
"They should work to define more threats, add more security, and make it more compliant with more security companies."
"I am not satisfied with AWS technical support."
 

Pricing and Cost Advice

Information not available
"There are no separate licensing costs we pay for since it is included in the plan we purchase."
"The price of AWS WAF is expensive if you do not know how to manage your software up or down. I price of the solution is average amongst the other competitors but it would be better if it was less expensive."
"It's an annual subscription."
"You need an additional AWS subscription for this product if you are buying a managed tool."
"AWS WAF costs $5 monthly plus $1 for the rule. It's cheap, cost-wise. It's worth the money."
"The solution's cost depends on the use cases."
"The product’s pricing is reasonable."
"For our infrastructure, we probably pay around $16,000 per month for AWS WAF. Because alternative WAF solutions provide even more features, I think the AWS WAF is a bit pricey"
report
Use our free recommendation engine to learn which Web Application Firewall (WAF) solutions are best for your needs.
914,109 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
27%
Hospitality Company
13%
Manufacturing Company
10%
Outsourcing Company
10%
Financial Services Firm
13%
Manufacturing Company
9%
Comms Service Provider
8%
Outsourcing Company
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business22
Midsize Enterprise12
Large Enterprise28
 

Questions from the Community

What needs improvement with Atomic ModSecurity Rules?
Atomic ModSecurity Rules can be improved by first studying and reading the structure of new obfuscated attacks, then trying to generate more specific and better rules to block these attacks, and th...
What is your primary use case for Atomic ModSecurity Rules?
My main use case for Atomic ModSecurity Rules is in my research, which tries to make websites secure against web attacks like SQL injection and XSS attacks. On one side, I try to generate some obfu...
What advice do you have for others considering Atomic ModSecurity Rules?
I would rate Atomic ModSecurity Rules nine out of ten. I chose nine out of ten because I have not studied other WAFs. I know that ModSecurity is the only open source WAF, but I believe that the oth...
What are the limitations of AWS WAF vs alternative WAFs?
Hi Varun, I have had experienced with several WAF deployments and deep technical assessments of the following: 1. Imperva WAF 2. F5 WAF 3. Polarisec Cloud WAF Typical limitations on cloud WAF is t...
How does AWS WAF compare to Microsoft Azure Application Gateway?
Our organization ran comparison tests to determine whether Amazon’s Web Service Web Application Firewall or Microsoft Azure Application Gateway web application firewall software was the better fit ...
What is your experience regarding pricing and costs for AWS WAF?
AWS WAF is affordable; it depends on the number of rules you apply. The licensing cost for AWS WAF is just pay-as-you-go; it is a service-based model.
 

Also Known As

No data available
AWS Web Application Firewall
 

Overview

 

Sample Customers

Information Not Available
eVitamins, 9Splay, Senao International
Find out what your peers are saying about Imperva, Radware, F5 and others in Web Application Firewall (WAF). Updated: September 2026.
914,109 professionals have used our research since 2012.