Imperva Application Security Platform Reviews

We are a premier partner with Imperva. We usually recommend Imperva Web Application Firewall (WAF) more because our customers sometimes get a better deal, and many already have Imperva solutions on-premises. We help them move to the cloud and other related tasks.

Customers enjoy the rules implemented in Imperva WAF, which are updated automatically any time a new breach is discovered. This eliminates the need for backend changes or manual updates, making the system straightforward.

The valuable features of Imperva WAF include its effective security breach prevention through automatically updating rules. The support team answers cases quickly as well.

The product's customization capabilities are a bit problematic, requiring support cases for backend modifications. 

Additionally, the handling of high-traffic volumes could be better, as it doesn't cut you off if you exceed your purchased traffic. Our clients like the guarantee that they won't be charged for exceeding traffic during peak periods. Users also need to be more attentive to false alerts, as the marketing might give a false sense of trust.

I have been dealing with Imperva for three years, while my company has been involved for more years.

Imperva WAF does not appear to handle high traffic volumes optimally during peaks as it only notifies clients if they exceed their purchased amount of traffic. However, it does not immediately cause any issue unless the excess persists over time.

Their technical support is rated nine out of ten. Support cases are answered quickly.

The setup is straightforward. Clients often manage it themselves, and no action is required on their end for implementation.

On occasion, we help our clients get on the cloud as part of our partnership with Imperva.

The pricing tends to be expensive. As premier partners, we get good deals, however, without such deals, it is usually quite costly. The cost also varies based on the plan that clients choose.

Imperva Web Application Firewall is recommended for companies needing a robust cloud-based solution. For on-premises versions, it might be considered outdated.

I'd rate the solution nine out of ten.

We use Imperva for our web applications that we have hosted to protect them.

With our deployment setup, the benefit is regarding the security and how threats have been blocked. It's not studied in terms of resources or speed. The threat prevention is the aspect we are monitoring.

Empower administration is user-friendly, and we do not need much for managing day-to-day operations. It is easy to use and has good security. Also, it is very customizable, especially for controlling web browsers and devices.

I would prefer AI integrations for user administration, visualization, log analytics, and risk analysis. If they can bring in generative AI features, that would be useful.

I am working with Imperva at the moment and have been using it for maybe six to seven years.

It's very stable. We haven't had any issues.

Scalability is not a problem since we have enough resources as it's an on-premises version.

We have escalated to tech support and it's quite good. I would rate them a seven point five out of ten.

We didn't use any WAF product before Imperva.

The initial deployment was seamless, and there weren't many complexities.

The deployment was done by a separate company within the company.

I do not have much understanding about F5 yet as I am currently evaluating their solution.

I suggest looking for a cloud-based solution rather than on-premises, which might improve availability, stability, and security.

I'd rate the solution nine out of ten.

I handled web application and database monitoring, including some DDoS work. I implemented Imperva for a top-five bank in Indonesia, monitoring their service and database activity.

Firstly, Imperva monitors all traffic, even customer access, to the web application. Then, Imperva uses features like signatures to identify attacks like cross-site scripting or SQL injection.

It's important to note, if you don't have dynamic profiling, you can use manual configurations. For instance, you can configure a text field on a website to limit input to only numeric characters and specific special characters. 

This helps protect against SQL injection, as these attacks often use special characters to try and break the website's security.

Imperva Cloud WAF would be the most powerful option. It uses cloud-based signatures, which are constantly updated. This is different from the on-premises version, where the signature updates might be less frequent.

Imperva has basic reporting templates. We can use those, and we can also create custom reports. However, customization is limited to labels and structure – we can't change the actual content of the reports. For that, we need to use Imperva Compass.

Overall, I would rate the user experience an eight out of ten, with ten being good experience. 

The signature updates could be faster. Sometimes we have to upload signatures to the Imperva portal for checking and analysis before we can use them.

I have some experience, but not with its on-premise solution. We used their cloud-based WAF, likely Incapsula.

I would rate the stability an eight out of ten. 

I would rate the scalability an eight out of ten. 

Sometimes the customer service and support response time is long. And sometimes, it is fast. 

Positive

The initial setup for Imperva isn't too difficult. We start with a script, setting up the IP, network, and gateway. Then, we inject the license and test on-site for monitoring our web application. 

If we're using dynamic profiling, we configure that, ensuring it works properly. After about one or two weeks, we begin fine-tuning and limiting form types.

The price is high compared to other solutions like FortiWeb.

I would rate the pricing an eight out of ten, with one being cheap and ten being expensive. 

I would recommend it. Overall, I would rate the solution an eight out of ten. 

At my previous workplace in the banking sector, we used Imperva WAF for the monitoring of our internet banking traffic, and we also used Imperva's DAM for the database activity monitoring.

Our deployment of Imperva WAF was situated on-premises and it was in use throughout the whole organization, which included around 3,500 clients.

Imperva Web Application Firewall has improved security of my organization through enhanced visiblity as well protecting malicious IPs, applications and unknown users as well.

The WAF itself has been very valuable to me because it has such a complete range of features. Another reason why I like it is because it also takes care of the total overview of the traffic over the network.

Imperva's product is very good, but when it comes to procuring the software in my country it can be somewhat expensive. I don't recall the exact amount, but in comparison with other countries it is a huge investment.

They recently separated the WAF and the DAM management gateways in order for each of these to be managed from different areas, so I believe it now requires additional investments for what was previously a single complete solution.

Although the vendor support from Imperva is not bad, getting a response from them can be a lengthy process at times.

I have used Imperva WAF for about three years. 

The stability is mature enough, in my experience. In fact, I would give it a 5/5 for stability.

Scalability-wise, there is one issue we encountered that I want to mention. At some point, Imperva, moved their account takeover prevention features from the on-premises edition to the cloud-based edition, and we discovered that this step would take yet another integration, seeing that we were using Imperva on-premises. These account takeover prevention features, however, were already part of our subscription, but since the features moved to the cloud, we missed out on them. So, in this sense, I would say the scalability strategy isn't as solid as it should be, and for this reason I would rate the scalability a 3.5/5.

On the other hand, when it comes to how many users we were able to scale up to, we actually had the whole organization using it, including around 3,500 clients in total.

The support from the vendor side could be improved because their response times weren't great and the process of obtaining the proper support was a long process sometimes. That said, the support itself was not bad.

Positive

The setup was actually quite an advanced process. It was a good experience, but all in all it took about one year to get everything fully set up, when you take all the fine-tuning activities and such into account.

We deployed the Imperva WAF with the help of organizations in South Africa who acted as consultants and implementation partners for Imperva. Our experience with them was good, and the full implementation required two professionals from the consultant's side and about five people from our own organization. The vendor itself was not part of the implementation process.

The pricing is somewhat expensive. It is actually a huge investment when compared to other countries.

Not only that, but Imperva went on to separate the WAF and DAM management gateways, making it so that each would have to be managed and licensed separately, incurring the cost of additional investments.

On a related note, there was another licensing issue we encountered where we had a subscription for account takeover prevention features, but these features had been moved by Imperva from the on-premises instance to the cloud. Since we had not moved to the cloud at that point, we did not have access to these features anymore.

I can highly recommend Imperva WAF for financial institutions. It's a good solution and I think it's important for financial institutions, particularly those who conduct online banking, to make use of a solid WAF such as this.

I would rate Imperva WAF a nine out of ten.

I am impressed with the product's automatic bot mechanism. It also gives us the control to create our own custom bot rules. 

The tool needs to include artificial intelligence and machine learning. It also needs to improve profiling. 

The tool is stable. 

The product's setup is pretty easy. 

The tool's pricing is good. 

The solution is a reliable product. I would rate the tool an eight out of ten. 

They provide end-to-end data security, so everything to do with applications, APIs, et cetera.

We've got a Telco client, and they'll be partnering with us to use the DDoS solution with their clients.

It's primarily for DDoS attacks. It's looking at anything that's trying to remove the ability of the company to operate, usually volumetric, however, since it's got a three-second SLA, it's better than the competition.

We can look after an entire what used to be a Class C network/24. Now, they could do single IP addresses, so they can protect a single IP address, and they have a three-second SLA to stop an attack. They back that up with a very large amount of money as well, so you've got a guarantee on it.

It’s hard to think of an improvement. The three-second service level agreement is already better than the competition.

You would ordinarily say something like API protection. However, they've got that with another product. It's not that DDoS protection does everything. It's that within their family of products, they've got a solution for everything. That's what I like about it, the whole integrated service. There’s nothing that’s missing in terms of features.

We've been working with Imperva for about a year, and we've been working on a particularly big client at the moment as well.

The product is stable. It's resilient architecture. If one site is down for maintenance, then another site will take over the load.

It's very, very scalable. They've just added a lot more capacity to it. It's something like six or nine terabytes per second of protection capacity, which is more than the biggest attack there's ever been by quite a margin.

Technical support is very, very responsive. They're very good and they've got strength in depth. Across the world, they've got people. We deal with the local guys in the Netherlands, and they're pretty good.

Positive

The setup itself is straightforward.

It's quite quick. It can be done as a reactive solution. Therefore, if somebody rings up and says I'm being attacked, we can get them onboard very quickly.

You only need one person to handle the deployment. It's all done virtually. We're working with the Telco and the Telco sends out the BGP VPNs and we just reroute traffic. It’s all very easy.

There's no maintenance as such apart from reports on traffic utilization. If you are using it as a continuous service, if you're running it continuously rather than just invoking it when there is a DDoS attack, then you get reports basically on your utilization of traffic and the types of traffic that you're transporting, et cetera. It helps you improve your security.

We're doing the deployment for the client.

The ROI depends if you're being attacked or not. If you're the sort of organization that gets regularly attacked, then the ROI is extremely high as you could be down for quite some time with a DDoS attack. What usually happens these days is they don't have long attacks. They have very short attacks. However, the idea is to take down parts of the infrastructure to attack other parts. Therefore, it’s a diversion attack in many cases. Due to that, it's one of those products. It's very difficult to say what the ROI might be since it depends on what people are trying to do. However, it's the precursor to a lot of attacks.

The solution is very affordable. It's based on the traffic utilization, the average traffic utilization, not the DDoS traffic. Therefore, if you're being DDoSed, you don't pay extra for the absorption of the DDoS traffic. It's purely based on your average traffic.

We're an end-to-end Imperva partner. We're an Imperva reseller.

We're building an MSP at the moment, and it starts with a number of solutions. We then add on for those that have cloud exposure. We’ve added CloudWave DDoS and the API Protection and Bot Protection, and then for companies that have GDPR requirements, we've got the database side.

We use a cloud deployment with a variety of cloud providers. The telco, for example, is on the Equinix cloud. They're on a variety of data center sites. A lot of it is Equinix. I can't remember the name of the other providers, however, that's not relevant to us particularly since we are bringing in another Telco partner.

I’d rate the solution eight out of ten.

Imperva Web Application Firewall can improve by adding more features to the dashboard. increasing the visibility of the real-time events, besides configuring the administration itself. 

The automatic reporting system is good, but it needs more templates. For example, better made for the management and for system admins, and monitoring teams. This would be great. 

 We want to send any configuration change automatically to the management. However, I think the automatic reporting feature is not enabled on Imperva. We had to instead look at the audit log for the last 24 hours, check and generate the report to send to the management. 

I have been using Imperva Web Application Firewall for approximately three years.

Imperva Web Application Firewall is a highly stable solution and is very mature.

The price of Imperva Web Application Firewalls is expensive compared to others.

We stopped using Imperva Web Application Firewall mostly because at the time we need to upgrade our devices to the latest version. After four years, we didn't pay the license for the solution because we were updating our team solution also. After one year, when we tried to upgrade it, Imperva ask us for the last one-year license renewal and they didn't accept our devices. They wanted us to purchase the new versions for approximately $859, which was too expensive for our budget. The cost with implementation is approximately $2,000,000 because we were expected to deploy eight devices. There were other products that were cheaper and they could meet our mandatory requirements.

If companies want to use Imperva Web Application Firewall they will need to place their bids and they might have a budget for the solution it is a good solution.

I would recommend this solution to others.

I rate Imperva Web Application Firewall a nine out of ten.

The solution is used by SMBs and enterprises that have a lot of websites that they need to protect.

Since the product is categorized in Gartner as a Web Application and API Protection tool, it protects APIs and web applications. It provides bot and client-side protection. I have done POCs. Once the platform is configured to block DDoS attacks, no traffic regarding DDoS or bots gets into the application.

If the clients have requirements for APIs and microservices, we can offer such services with the help of the solution. We can offer it as a security solution that protects APIs and microservices. Imperva’s real-time monitoring makes it very easy for administrators to monitor their existing web applications.

My clients raised a concern that even if they need the tool only for DDoS protection, they still have to buy the WAF license. It’s difficult to position the tool if the client already has a WAF solution and needs Imperva only for DDoS protection.

I have been using the solution since June last year.

I rate the tool’s stability a ten out of ten. Since I've been onboarded, I haven't had any issues.

I rate the tool’s scalability a ten out of ten. Imperva allows only clean traffic. The scalability is based on the clean traffic and not the overall bandwidth of the client. Our clients are mostly enterprise businesses. I have some SMB customers.

Sometimes, support tickets don't get addressed quickly. However, the support team gets to it eventually.

Positive

The initial setup is very easy. I rate the ease of setup a ten out of ten. The time taken for deployment depends on the number of applications we want to onboard. Usually, we can do it in a day.

Imperva is a very proactive solution. It is not reactive. We can prevent attacks or issues even before they happen. It is something people must consider since many enterprises are facing DDoS attacks, and their data is getting compromised.

I rate the solution’s pricing a seven out of ten. Some solutions are cheaper than Imperva. Imperva’s pricing is a bit higher in the market since it offers a full-blown WAF.

We are partners. I rate the product's integration with our client's IT infrastructure a nine out of ten. It is easily integrated since many configurations are needed to onboard Imperva into a client’s infrastructure fully. Overall, I rate the product a nine out of ten.