Imperva

Enterprise WAF and DDoS protection

3.2(0 reviews)paidFounded 2002

ddos protectionteam featuressso

Integrates with

Imperva provides enterprise WAF, DDoS protection, bot management, and API security, now part of Thales. 13 Tbps DDoS scrubbing capacity across 61 data centers. Quote-based pricing.

What Imperva actually is

Imperva is a web application firewall and edge-security platform with two decades of enterprise deployment behind it. Founded in 2002, headquartered in San Mateo, California, and acquired by Thales for $3.6 billion in a deal completed on 4 December 2023, it now sits inside one of Europe's largest defense and security groups. That ownership matters for a security vendor: the question with WAFs is not whether the rules engine works today, but whether the company protecting your application will still be patching it in five years. Imperva's answer is about as strong as this market offers.

The stack covers the application-security surface in layers. Cloud WAF is the core: reverse-proxy inspection of HTTP(S) traffic with managed rule sets, virtual patching, and granular policies. Advanced Bot Protection handles credential stuffing, scraping, and inventory-hoarding automation — historically one of Imperva's strongest capabilities. API Security discovers, tests, and protects APIs across deployment models. Client-Side Protection covers third-party script and Magecart-style threats. DDoS Protection absorbs volumetric and application-layer attacks at the edge. On the data side, the Data Security Fabric covers database discovery, classification, vulnerability assessment, user rights management, and risk analytics for on-premises and cloud repositories — the part of the portfolio that most distinguishes Imperva from pure edge players in our /category/firewall-ddos comparison.

Deployment is as an always-on reverse proxy or on-demand scrubbing for network ranges, with support for protecting individual IPs and on-premises services as well as websites. Every PoP runs the full security stack — DDoS scrubbing, WAF, bot protection, caching, and load balancing — so traffic does not need to hop between specialized facilities. The practical consequence is that onboarding a website is a DNS change rather than an infrastructure project, and mixing website protection with network-range protection under one policy framework is one of the few genuinely convenient aspects of the platform. Imperva also pushes virtual patching hard: when a vulnerability is disclosed in your application stack, a rule can go in front of it at the edge while your team schedules the real fix, which is the workflow that keeps WAFs earning their keep between release cycles.

Pricing: what you really pay

Imperva does not publish prices. There is no self-serve signup, no free tier, and no public price list for Cloud WAF, Bot Protection, or API Security; every engagement is quote-based after a sales process, with a trial available. We will not repeat the third-party figures floating around — one aggregator lists a $59-per-month entry point that is not credible for this product class, and older blog estimates around $500 per month are exactly that, estimates. What we can tell you is how to budget: expect a five-figure annual commitment for a meaningful Cloud WAF deployment, with pricing driven by protected domains, traffic volume, and which modules you enable, and expect discounts to move sharply at multi-year terms.

In our view this opacity is the single biggest reason most readers should look elsewhere. If you are a small team protecting one storefront, Cloudflare's WAF plans, AWS WAF's per-rule pricing, or open-source ModSecurity in front of a good CDN will cost a fraction of Imperva and cover the common cases. Imperva's pricing model is built for procurement departments, and the sales cycle is built to match. What you get in return is contractual teeth: negotiated SLAs, named support, and a vendor that will sign your security paperwork — plus a documented 3-second mitigation SLA for Layer 3 and 4 DDoS attacks, which is a stronger operational commitment than most competitors publish at any price.

The one publicly stated discount-style claim worth recording is Thales-era bundling and cross-product deals, which appear in enterprise agreements rather than on a pricing page. Everything else is a quote.

Performance & infrastructure

The network is the part of Imperva that is genuinely public, and it is substantial. The company's global network map describes 61 DDoS-resilient data centers with over 13 Tbps of scrubbing capacity, 60-plus points of presence, and more than 5,000 peering relationships. Imperva publishes live throughput figures — 25 million requests per minute, 5 million cached items per minute, 140,000 threats blocked per minute — and runs a public status page at status.imperva.com with follow-the-sun operations. The architecture separates local multi-function PoPs (full stack per location) from regional Super PoPs sited in connectivity hotspots for volumetric absorption, tied together by a software-defined mesh that redistributes scrubbing load during attacks.

Note the capacity number carefully: Imperva's marketing has historically been quoted at 6 Tbps in older coverage, and the current published figure is 13 Tbps. We have corrected our own record to the current figure. The 3-second mitigation SLA applies to Layers 3 and 4; Layer 7 attacks are mitigated fast in practice but the guarantee is worded around the network layers, which is the kind of precision we prefer in security SLAs.

On certifications and compliance, Imperva's portfolio is built for regulated industries — the Data Security Fabric ships compliance reporting for SOX, HIPAA, PCI-DSS, GDPR, and NYDFS, with more than 260 built-in integrations spanning SIEM, Splunk, CMDB, and SOAR tooling. A 2026 independent lab report (SecureIQLab's Cloud WAAP assessment) named Imperva a Leader, which is a useful counterweight to the fact that we have not tested the WAF ourselves — our /benchmarks work covers compute, not security appliances.

Where it falls short

Pricing opacity, as above. Second, configuration complexity: the policy model is deep enough that a misconfigured Imperva deployment can block good traffic for weeks, and the tuning expertise required is a real cost on top of the license. Enterprises buy professional services for exactly this reason. Small teams without a security engineer should not attempt it.

Third, the interface and product packaging reflect twenty years of accretion and the Thales integration: multiple consoles, product names that overlap, and documentation that sometimes spans legacy and current branding. Fourth, the self-serve experience is absent — no free tier, no public signup, trial terms negotiated — which puts the product out of reach for the long tail of developers. Fifth, while the DDoS and bot capabilities are strong, the per-module pricing means the "full platform" price is a different conversation from the entry WAF, and vendors in this category are rarely transparent about where one module ends and the next begins.

Finally, a note on fit: Imperva's strengths — bot management, API discovery, data-security analytics — matter most at scales where those problems are expensive. Below that scale, they are costs without returns. One more consideration for enterprise buyers: since the Thales acquisition closed, procurement conversations increasingly involve framework agreements and cross-sell into the wider Thales portfolio. That can be convenient if you already buy from Thales, and friction if you do not. Ask explicitly which contracts Imperva signs under today, and what happens to support ownership if your account is folded into a larger group agreement. Nobody enjoys discovering the answer to that question during an incident.

Who should pick this

We pick Imperva for enterprises in financial services, e-commerce at scale, healthcare, and government-adjacent sectors that need a proven WAF with bot management, API security, and volumetric DDoS protection under one vendor, and that need a supplier who will sign security questionnaires, comply with sector regulation, and stand behind a mitigation SLA. If you process enough traffic that a credential-stuffing wave or a 500 Gbps attack is a real scenario, the price of this platform is small relative to the incident.

We would not pick it for small businesses, startups, or any team whose security needs are "stop SQL injection and the common OWASP set." For those, a CDN-tier WAF or managed rules in front of your existing provider deliver most of the value at a twentieth of the cost, and you can revisit Imperva when the traffic and the threat model justify it.

Key takeaways

Enterprise WAF platform: Cloud WAF, Advanced Bot Protection, API Security, Client-Side Protection, DDoS, and Data Security Fabric under one vendor (Thales-owned since December 2023).
Network is real and published: 61 DDoS-resilient data centers, over 13 Tbps scrubbing capacity, 60+ PoPs, 5,000+ peering relationships — not the 6 Tbps figure still circulating in older references.
Contractual 3-second mitigation SLA for Layer 3 and 4 DDoS attacks — unusually specific for this market.
Pricing is quote-only: no free tier, no public price list; expect a five-figure annual commitment and a sales process.
Configuration depth is a double-edged sword: strong control, real tuning cost, and a need for security-engineering skill.
Right for regulated, high-traffic estates; overkill and overpriced for small deployments that a CDN-tier WAF would cover.

Sources

Pros

13 Tbps scrubbing capacity across 61 DDoS-resilient data centers with full security stack at every PoP
Contractual 3-second mitigation SLA for Layer 3 and 4 DDoS attacks
Deep portfolio: WAF, bot management, API security, client-side protection, and data-security analytics
Thales ownership and a 20+ year track record suit regulated industries and long procurement cycles
260+ built-in integrations with SIEM, Splunk, CMDB, and SOAR tooling

Cons

Quote-only pricing with no free tier or public price list
Configuration complexity requires real security-engineering effort to tune
Console sprawl and legacy/current branding overlap after years of product accretion
Module-by-module packaging makes full-platform cost hard to predict
Overkill for small deployments that a CDN-tier WAF would cover

Best For

Enterprises in financial services, large e-commerce, and regulated industries needing proven WAF, bot management, and volumetric DDoS protection with contractual SLAs