Web Application Firewalls

The KuppingerCole Market Compass analyzes the Web Application Firewall (WAF) market by outlining key trends, deployment models, essential capabilities, and comparative vendor ratings. WAFs remain foundational for protecting web applications by inspecting HTTP traffic—often as a reverse proxy—using signatures and rules to block common exploits such as those in the OWASP Top 10, while also supporting logging, reporting, and centralized management.

The market is shifting from traditional on-premises appliances toward cloud-delivered WAF-as-a-Service, driven by hybrid and multi-cloud architectures and the need to scale globally. Cloud WAFs can mitigate malicious traffic before it reaches an organization’s perimeter and can aggregate broad threat intelligence from large customer bases and globally distributed infrastructure. Containerized WAF components are also emerging to keep protection close to microservices while still leveraging cloud-based analytics and control planes.

A major driver for “advanced WAF” capabilities is the changing attack landscape, especially bot traffic: over 30% of online traffic is attributed to bots, and around 20% of those bots are malicious, including attempts to log into user accounts. Because signature upkeep is continuous and labor-intensive, many organizations increasingly adopt managed WAF services with 24/7 security operations centers, selecting partial or full outsourcing based on internal skills.

Beyond baseline DDoS and signature defenses, buyers are encouraged to assess bot management, API protection (REST, JSON/XML validation, GraphQL/WebSockets in some cases, and gaps like SOAP support), AI/ML-based anomaly detection, and intelligence feeds. The report evaluates multiple vendors across security, usability, core protection, threat intelligence, bot management, API protection, centralized management, and ease of delivery, highlighting Imperva (comprehensiveness), AWS (capabilities breadth), Radware (innovation via ML auto-policy and Kubernetes support), and ThreatX (newcomer with behavior-focused WAAP).

• Web Application Firewalls protect web applications by inspecting HTTP traffic.
• WAFs were traditionally deployed on-premises to protect internal intranets and external internet-facing applications.
• WAFs often act as a reverse proxy to inspect requests before they reach the origin web application.
• Over 30% of all online traffic is attributed to bots.
• Roughly 20% of bots within website traffic are malicious.
• Some malicious bots attempt to log into user accounts.
• The WAF market supports on-premises, cloud (public/private/multi-cloud), and hybrid deployment models.
• AWS Shield Advanced includes AWS WAF capabilities at no additional cost and provides access to 24/7 managed WAF services.
• Cloudflare’s WAF uses DNS to direct traffic to and from customer networks, requiring no software installation.
• Akamai’s edge platform spans over 250,000 servers across 1,600 networks in 137 countries and is within direct reach of over 90% of Internet users.

• “Keeping up with new attacks using the traditional signature rule approach is a never-ending process.”
• “Managed services allow organizations to off-load the maintenance and monitoring of WAFs using the service’s 24/7 security operations centers.”
• “One of the key benefits to WAF cloud solutions is their ability to scale well with an organization's need by using massive datacenter networks with global distribution points.”
• “Cloud WAF service also has the benefit of mitigating malicious web traffic before it gets to an organization's network perimeter.”
• “Although the WAF market is rather mature, there are some key differentiators between the different WAF solutions.”
• “Bot attacks have become commonplace in the web threat landscape and are becoming an expected feature in WAF products.”
• “Protection at the API level is becoming an advanced feature seen in more modern WAF solutions.”
• “Picking solutions always require a thorough analysis of customer requirements and a comparison with product features.”
• “The market direction observed… is that the WAF market trend is moving towards WAF as a service in the cloud.”
• “Customers have the option to get handle all aspects of the WAF themselves or allow AWS to manage the WAF service for them fully.”