No more typing reviews! Try our Samantha, our new voice AI agent.

Atomic ModSecurity Rules vs F5 Advanced WAF comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Atomic ModSecurity Rules
Ranking in Web Application Firewall (WAF)
29th
Average Rating
9.0
Reviews Sentiment
7.8
Number of Reviews
1
Ranking in other categories
No ranking in other categories
F5 Advanced WAF
Ranking in Web Application Firewall (WAF)
3rd
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
72
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of October 2026, in the Web Application Firewall (WAF) category, the mindshare of Atomic ModSecurity Rules is 0.8%, down from 1.0% compared to the previous year. The mindshare of F5 Advanced WAF is 3.4%, down from 7.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Web Application Firewall (WAF) Mindshare Distribution
ProductMindshare (%)
F5 Advanced WAF3.4%
Atomic ModSecurity Rules0.8%
Other95.8%
Web Application Firewall (WAF)
 

Featured Reviews

Vahid Babaey - PeerSpot reviewer
PhD Student at University of North Carolina at Charlott
Open rules have enabled me to secure web apps against obfuscated SQL injection and XSS attacks
The best feature Atomic ModSecurity Rules offers is the open source aspect. I believe that because it's open source, all of the developers, programmers, and security experts are able to update this WAF and provide more rules, creating a more secure WAF for all of the clients and customers around the world. By accessing Atomic ModSecurity Rules, it has helped me significantly. Because of this open source feature, I am able to generate new rules and update the WAF and use this WAF in my research and also give it to other clients and customers to use the updated WAF. All of this is done just because of the open-source feature, because it can be updated.
reviewer2797602 - PeerSpot reviewer
Senior Security Systems Engineer at a tech services company with 11-50 employees
Granular security policies have protected critical applications and ensure safe user and admin access
Improvements could be made regarding the log information from the backend CLI. There are enhancements needed; if a request gets blocked on the TCP layer, there should be traces or data to verify which source generated these requests, including the source and port information for initiation. These data are missing from F5 Advanced WAF. Besides that, another improvement could be refining the bot detection to minimize false positives; it should be able to verify more granularly between legitimate and non-legitimate clients. Overall, I find everything else good. A wish list feature I have is for the Technical Assistance Center (TAC) to respond more promptly. Their response time needs improvement; while they do not take excessive time, it can be enhanced, especially given it is a security product.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The best feature Atomic ModSecurity Rules offers is the open source aspect, because all of the developers, programmers, and security experts are able to update this WAF and provide more rules, creating a more secure WAF for all of the clients and customers around the world."
"The most valuable feature of F5 Advanced WAF is its grand unity of the implementation, where you have the freedom to configure based on how it affects your use case or your organization. With the default setting of implicit deny, you can gradually start defining and deploying the tool to align with your environment, whether it is outdated, recent, or futuristic. This allows you to customize the solution to protect you from threat actors. You have the ability to define what the advanced threat act should do - whether it should alert, deny, or both - and it will deliver based on your configuration. Unlike other online solutions, F5 Advanced WAF provides flexibility to deliver to your unique environment the way you want."
"The solution uses AI to protect against botnet attacks."
"I appreciate the way F5 Advanced WAF builds policies by configuring a basic policy and queuing it in learning mode."
"There are two main features that we love on F5."
"When you choose to go with F5, be sure to size your box properly so that the capacity is taken care of."
"The product is very stable; it is a PCI company, so there are 10,000-12,000 people using the solution, and all of the internet payments are behind the ASM for the F5."
"Web attack signatures are very important for detecting web attacks."
"The level of configurability that I get with F5 Advanced WAF solution is immense, and I have to be a bit aware of how it works and all of its features, but at the end of the day, it is all about the administration expertise that I will require to have and use it to my liking based on the kind of services that I have onboarded on my solution itself."
 

Cons

"Additionally, I know that ModSecurity can block only SQL injection and XSS attacks, no more types of attacks."
"The product could be more user-friendly for administrators."
"Initially, policy tuning could be simpler, as while the learning engine is powerful, initial tuning still requires experienced engineers, which can be challenging for new teams due to the complexity of options and parameters."
"We get false positives sometimes."
"The product could be more user-friendly, particularly the user interface for administrators."
"There should be more ability to rate limit certain scenarios. The majority of the time, it is either on or off. For certain types of use cases, there should be the ability to rate limit, not just enable or disable."
"The accuracy of the automatic learning feature needs improvement."
"I would like for there to be a cloud-based solution, this would also help to improve scalability."
"My advice to future customers of F5 Advanced WAF or to people thinking of using it is that there is a much better product in the market."
 

Pricing and Cost Advice

Information not available
"The price of the solution is reasonable when compared with other products, such as FortiWeb. I am very satisfied with the price."
"Pricing for this solution is higher than average."
"The way we deployed it, I would rate it a four out of five in terms of pricing."
"I would rate the pricing as seven out of ten"
"It is expensive. Its price should be better. Its licensing is on a yearly basis. Its licensing is also based on the model. There are no additional costs."
"It is a little bit costly, but it has all the features that are required."
"F5 Advanced WAF pricing structure should be adjusted to meet the need of small to medium-sized companies."
"As far as the pricing of F5 Advanced WAF I would rate it a four out of five depending on what features I am looking for. Imperva is more expensive."
report
Use our free recommendation engine to learn which Web Application Firewall (WAF) solutions are best for your needs.
916,240 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
29%
Hospitality Company
12%
Manufacturing Company
10%
Construction Company
9%
Financial Services Firm
15%
Comms Service Provider
9%
Outsourcing Company
9%
Computer Software Company
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business27
Midsize Enterprise16
Large Enterprise31
 

Questions from the Community

What needs improvement with Atomic ModSecurity Rules?
Atomic ModSecurity Rules can be improved by first studying and reading the structure of new obfuscated attacks, then trying to generate more specific and better rules to block these attacks, and th...
What is your primary use case for Atomic ModSecurity Rules?
My main use case for Atomic ModSecurity Rules is in my research, which tries to make websites secure against web attacks like SQL injection and XSS attacks. On one side, I try to generate some obfu...
What advice do you have for others considering Atomic ModSecurity Rules?
I would rate Atomic ModSecurity Rules nine out of ten. I chose nine out of ten because I have not studied other WAFs. I know that ModSecurity is the only open source WAF, but I believe that the oth...
What is your experience regarding pricing and costs for F5 Advanced WAF?
F5 Advanced WAF is somewhat costly compared to other vendors, but it is worth the investment due to the stability it provides to the environment and infrastructure.
What needs improvement with F5 Advanced WAF?
Improvements could be made regarding the log information from the backend CLI. There are enhancements needed; if a request gets blocked on the TCP layer, there should be traces or data to verify wh...
What is your primary use case for F5 Advanced WAF?
My main use case for F5 Advanced WAF is to protect external and internal applications from cyber attacks and to prevent malicious payloads and malicious data from reaching servers. Even if maliciou...
 

Overview

 

Sample Customers

Information Not Available
MAXIMUS, Vivo, American Systems, Bangladesh Post Office, City Bank
Find out what your peers are saying about Imperva, Radware, F5 and others in Web Application Firewall (WAF). Updated: October 2026.
916,240 professionals have used our research since 2012.