Imperva Application Security Platform Reviews

My main use case for Imperva Application Security Platform is onboarding the application on Imperva.

To onboard an application on Imperva, we start with sites, under which we have server groups. Under the server group, we have our applications. So I create a site; let's suppose India is a site. In India, we have multiple regions, we can say states, like Maharashtra and Jaipur, Bangalore. I create a server group, and under that, I can create another, and into that, I can add our applications. For example, in Hyderabad, we have our major applications, so I can add those major applications into the Hyderabad segment, while the same application which works as a DR would reflect on the Jaipur site.

In onboarding, we provide the IP address, FQDN, and the port as well. I put the application into simulation mode for about 15 days. After 15 days have passed, I apply the default policies, whatever the default policies we have. Then, I move the application into blocking mode. Every day, I monitor the traffic pattern, the traffic count, and whether any traffic is getting blocked, checking which particular policy the traffic is getting blocked in. Additionally, if users have requirements for custom policies or custom error pages, I work on that as well.

The best features Imperva Application Security Platform offers include the ADC. Imperva releases their policies every 15 or 20 days, and we have almost covered all the OWASP Top 10 related issues.

In my day-to-day work, the ADC helps because Imperva updates the latest signatures, latest policies, and whatever the latest alerts have been found, creating their policies without requiring us to do a lot of work. I simply update the ADC, and whatever new policies are in Imperva are reflected on our platform as well. This allows me to communicate to the organization that we have the up-to-date policies regarding the latest attacks that have been identified.

Imperva Application Security Platform impacts our organization positively in many ways, such as protecting our applications. Additionally, during compliance audits, I can show what attacks we have prevented and how Imperva helps us mitigate threats. There is also bot protection and CAPTCHA features. I recall a time when we were facing attacks on an application; I identified the issue, and based on that, I created a rate-limiting policy on Imperva, which significantly helped our organization.

I believe Imperva Application Security Platform should have a more interactive wizard. While the dashboard is good, it could be more eye-catching. Based on my perspective, I recommend modifying the dashboards, especially the main dashboard where I can see the traffic hit count, alerts, and other latest information.

In terms of reporting, I find it challenging to create reports; in my earlier days, it was difficult. Over time, I have learned how to create reports, but it should be easier to do so. I have used other tools such as firewalls or SolarWinds, where creating a report is straightforward and does not take much time, unlike in Imperva, where I have to add many elements. Modifications in the integration aspects would also be beneficial.

I have been using Imperva Application Security Platform for 1.5 years.

Imperva Application Security Platform is now stable because we have upgraded it.

We have seen a reduction in attacks because, during a DDoS attack, a lot of requests were made for a single application, preventing legitimate users from accessing it. Thanks to Imperva, I implemented a rate-limiting policy—if a user hits around 300 or 400 requests in five minutes, that IP gets blocked. I protected our applications through this method. Moreover, by analyzing our day-to-day logs, I have identified many latencies. For instance, we have F5, and while it decrypts the traffic, Imperva inspects it, and I have faced numerous challenges due to F5. However, on Imperva, I experience no latency.

The customer support I have encountered is really good.

We previously used F5, but we faced issues related to utilization. We encountered many challenges with F5 crashing due to high traffic, which led us to replace it with Imperva, though I still sometimes face utilization issues with Imperva where it may reach up to 90 or 95 percent but does not crash.

As such, I have not seen a return on investment.

To be honest, I am not handling the pricing costs, so I am unsure about that aspect.

We have a DCDR setup, and because we are on-premises, we have created our DC and DR. We test our DC and DR every three months by switching traffic from the DC to DR for seven days before switching back to the DC.

I suggest others looking into using Imperva Application Security Platform consider it as the best solution. I have worked with both F5 and Imperva, and while F5 offers many solutions in one box, it can lead to numerous issues, and Imperva's feature capabilities surpass those of F5. I definitely recommend Imperva. I would rate this product a 7 out of 10.

On-premises

My main use case is regarding API Security, specifically trying to do some schema enforcement. I would say that is my main use case, so having to make sure the schema enforcement is done and also some DDoS protection in the aspect of web application firewalls and making sure DDoS protection is done also for bot protection, as well as some of the use cases I have had in recent projects.

In a recent project, we had one of our clients, a major financial institution in Eastern Europe. They were trying to resolve some issues with bots having access to some tangible data in their application. They had an external firewall they were using, but it was not backing up whatever alerts that needed to be obtained to make sure things are well secured. We came in and configured Imperva Application Security Platform on the web application. We made sure the DDoS protection feature was activated, so the admin is also alerted to whatever attack is coming in and then they are able to do the right measures to make sure it is stopped.

Some of the best features are the policy tuning, where you are able to tune policies the right way without stress or much hassle. The DDoS protection, the OWASP Top 10 feature, and the bot protection feature are also excellent. The API security feature is particularly valuable because most attackers do not try to come in from where it is expected. Most attackers attack the API that is being used on a platform.

The policy tuning is one of the easiest features that I know. Once you are trying to customize a policy, you just need to understand what kind of policy you are trying to customize, go through the right place from the security to policies, then create a policy. For example, you might be trying to set a policy to make sure that it does not save credit cards on a particular platform or website. That is basically one of the simplest ways of ensuring policy tuning works fine. It is one of the easiest features and I believe it has done a great deal for me in the aspect of operating Imperva Application Security Platform.

From my research regarding the IAM space that Imperva Application Security Platform is trying to look into, I believe they still need to do a lot of modeling and modification to make sure that also helps. There are several competitors in the IAM space, so Imperva would do well if they can do some basic modeling and modifications from my own personal research and my own experience in the IAM space. Alternatively, they could actually just focus on trying to be stronger in the web application space and the database activity monitoring space.

The main reason it is not a perfect ten is regarding support. At times, having to reach the support team takes eight hours to ten hours maximum. There are times when clients could have urgent issues to attend to. The support team could do more by having a faster response rate.

I have been working for over three years in this space.

Imperva Application Security Platform is very stable, very, very stable.

The scalability of Imperva Application Security Platform is easy and well organized, so you can easily upgrade the version of the model you are using. It is easy to always scale to add more users. It is easy to always scale to add more endpoints and apps you are trying to secure.

For the customer support, the reason I rated Imperva nine over ten is basically because of the customer support. They need to work faster on the response time because of issues of urgent replies. They need to work perfectly on the faster response. Overall, it is a good customer experience with them. It has not really been hectic, but they can do better.

We did not use any previous solution regarding that. We were always on Imperva Application Security Platform because Imperva is one of the leading organizations regarding WAF and DAM.

Regarding licensing, it was a smooth experience. I had to reach out to the salesperson at Imperva who helped us with setting up costs and understanding what the client needs, and making sure the pricing and licensing is done. Licensing is always for a year. There are times when most of our clients do not actually remember where they do their licensing. The licensing certificate helps to understand the date and then gives the client the proper time to renew when necessary.

I was able to save over seven million dollars last year as return on investment in the company. Regarding fewer employees needed, we are able to employ more hands because we were one of the organizations that actually brought Imperva to Africa. We needed more Imperva engineers and from the way it is, Imperva engineers have not been that much in Africa. Training new employees and making sure they are attended to with Imperva is also an issue that we are trying to resolve in Africa.

We have noticed faster response times and fewer security alerts because after doing some custom policy tuning, everything seemed to be aligned and we have fewer attacks to monitor and fewer alerts to monitor. It was possible where we were able to integrate a SIEM solution that we were using with Imperva Application Security Platform. That is one of the features I enjoy about Imperva. You can stimulate and integrate whatever SIEM platform you are using to Imperva. Imperva sends over the logs and alerts to the SIEM, so it is easier for the blue team of your organization to read the alert and provide adequate measures to stop whatever is happening in the enterprise.

We evaluated Trendis and we also evaluated Check Point.

My basic advice would be to make your evaluations properly. It is okay to do demos as much as you can to fully see if it is going to work with whatever challenges you are trying to solve. I believe in thorough and proper evaluation of solutions. I can give a solid approval of Imperva Application Security Platform because it has really done a lot in helping my clients and giving them the best. Imperva is one of the best, if not the best. Almost every feature in Imperva Application Security Platform works really fine and it is what enterprises are battling, and what Imperva does in shaping the security culture of the digital world. Overall, I am going to rate Imperva Application Security Platform a nine out of ten, being one of the leading solution providers in the WAF space and the DAM space.

Hybrid Cloud

Amazon Web Services (AWS)

Usually, I work with web DDoS Protection on the website.

DDoS protection of web requests on the website is the most common use case.

Companies that are working through the site, selling through the site, and so forth.

The most valuable feature of Imperva DDoS is to make our website available for our customers' requests 24 hours a day. This feature may be the most interesting for the financial sector, for banks.

Over the seven years, the most valuable features of Imperva DDoS that I have found are related to DDoS attacks, which are a group of attacks, and not all of them can be resolved on the endpoint level before the website. Using the web firewall before the website is a common use case to protect against malicious requests to the website.

I have utilized Imperva's Intelligent Traffic Filtering feature. This feature helps me understand how the attack is progressing and what is happening inside the requests to our website. It allows me to granularly grant or deny access to certain parts of our website. This helps when we know our customers and the types of requests that can be sent from them, enabling us to block some malicious requests.

Imperva DDoS has User Behavior Analytics and Threat Intelligence on its board, and this helps us to be protected proactively. Imperva DDoS connects to its database of threats, storing whole information about attacks all over the world in one simple engine. Everyone can use this feature, which can connect to this engine and get information about what is going on at the world level. That is the way to be protected at the company's level.

The integration capabilities of Imperva DDoS are very easy and simple. We can run it in 2 hours.

I would like to see improvements in the pooling of threats and attacks, possibly to enlarge the scale of indicators of compromise. For example, the initiation of an attack on the endpoint level could be combined into a big denial of service. Maybe Imperva DDoS could use endpoints to get information about the attacks before they commence from the endpoint level or establish cooperation with endpoint vendors to share this information.

I have been working with Imperva DDoS for about 7 years.

The stability of Imperva DDoS is very good, as it seems they have a lot of servers around the world.

The scalability of Imperva DDoS is very easy to manage. 99% of customers are using the cloud version of Imperva DDoS protection, so they just purchase the new license and scale as needed.

A popular use case for scalability challenges is when customers want to move from on-premise infrastructure to the cloud, having a transmission period where they use both a copy of infrastructure in the cloud and the current infrastructure in the on-premise offices. This means they need to use double capabilities to protect both connections to the cloud and to the on-premise part of the whole infrastructure. During this period, customers can buy a subscription with double the scale of the needed throughput of protection.

I have interacted with the technical support of Imperva DDoS, and it is very easy. They are very professional, and communication goes through the technical support site. It's quite easy to register a support case and track the solution of your support ticket.

I would rate the technical support of Imperva DDoS as ten.

Before Imperva DDoS, I used a different solution that was Unix-based and not commercial versions of products.

I switched from the previous solution to Imperva DDoS because we started to integrate the products, and we saw that the capabilities were much greater than what we used to have. We also had a technical engineer on board who can manage these solutions easily and has a deep understanding of what is happening with our websites during attacks.

The initial setup and deployment of Imperva DDoS was quite easy. Customers just needed to provide the public IP address or the public name of their site, and we gave this information to Imperva DDoS to protect those sites. After the system is working, our technical engineer usually connects to configure some threat protection, role-based access control capabilities, reporting, and other minor configurations.

I work as an integrator.

I have calculated return on investment with Imperva DDoS, particularly in the financial sector with bank accounts, where the calculation is straightforward. Banks usually calculate their loss when they are not working. They know how much money they are losing while the system is down, so by increasing the possibility of not having a down website or web application, return on investment can be calculated easily.

The pricing, setup costs, and licensing of Imperva DDoS are reasonable for the amount of technical capabilities provided.

I would rate the pricing of Imperva DDoS as five, where one is very cheap and ten is very expensive.

I evaluated other options and vendors before choosing Imperva DDoS. We considered Akamai, but it was too expensive for us.

I don't remember the last version of Imperva DDoS I am currently working with.

When customers change their DDoS protection to Imperva DDoS or integrate Imperva DDoS as a new single DDoS protection product, they achieve full satisfaction with international standards like PCI DSS and GDPR. This is a seamless integration with international standards.

I don't see any improvements needed for Imperva DDoS, because it is a very niche product with niche capabilities. It's not a technical thing, because it is continuously approved. Some features appear, but it's more about small improvements. The attacks Imperva DDoS is constructed to protect against are very well-known, and the solution is effective in protecting against them. The system can protect against even zero-day attacks.

We get Imperva DDoS free as part of an MSSP approach, but for our customers, the average deal size for one year could be around 10,000 dollars.

On a scale from one to ten, I rate Imperva DDoS a nine.

Public Cloud

Amazon Web Services (AWS)

I use Imperva Application Security Platform for API security, which has a cloud solution where normal traffic flows horizontally, and a copy of the traffic goes to the cloud to be inspected. If there is something suspicious, it could be blocked depending on the action configured. Imperva Application Security Platform also has a solution for Database Activity Monitoring (DAM) as well as API security. I have been working with these solutions for around one and a half years, more than one year, as a partner collaborating with the vendor. The communication from the vendor flows through us, then to the clients, particularly the financial institutions and banks.

The data center for the bank is usually the headquarter, where the main data center is located in our country, and there are branches at every street. For the branches, every access is through the firewall and the core banking application server, and there is an integration between banks from different institutions. In this case, every communication is done through the API, necessitating API inspection and API security.

The main benefit is the use case my clients find valuable. For the product and security, there is good API inspection. If any abnormal API appears or there are any similarities due to changes, the API security features will catch that because there is access for third-party applications from one bank to another. This setup ensures there is segmentation, and allowed APIs will get access while others will be blocked. It serves as the main channel for third-party application integration, and without API security, any similar URL related access could affect core banking, which is vital for every financial transaction.

For real-time analysis, the deployment is arranged so as not to interrupt transactions. The normal traffic flow will continue, while a copy of the API traffic will be mirrored to Imperva Application Security Platform for deep inspection. If any abnormalities are detected, even unusual behaviors for transactions, checks are done continuously, and actions are sent accordingly if any suspicious traffic is found.

For the fast response of signature-based comparisons, traffic will be matched against the solutions stored in the database to release actions if similarities occur. However, the main drawback for signature-based approaches happens when there is a new zero-day attack that is not in the database. Solutions usually include integrity with lab environments so that zero-day attack signatures are sent through subscriptions to provide the latest updates.

The comparison for API protection varies across solutions. For F5, API protection is part of WAF, and similarly for Fortinet. While Imperva Application Security Platform has basic features as part of WAF, its dedicated API protection solution is a strong point.

On the negative side, API security mainly supports cloud-based solutions, while most of my customers prefer on-prem setups, so achieving high performance with on-prem solutions would be beneficial. The attractiveness of Imperva Application Security Platform is that not all data is exposed to the cloud. Only a mirrored copy goes to the cloud and is inspected, allowing actions to be taken on-prem. To convince my clients, a purely on-prem solution would be ideal since they are financial institutions.

I have been using the solution for more than one year.

I am more than happy with the technical support from Imperva Application Security Platform regarding data security and API security. For the support, however, one notable drawback is that, unlike Fortinet, which offers fast track labs and continuous enablement, Imperva Application Security Platform lacks lab access and fast track labs for enablement and product advertising. This weakness has shifted the marketplace toward other vendors. When creating a ticket for support during deployment, the response is satisfactory, though the gaps in enablement and lab sessions are clear.

I find Imperva Application Security Platform to be a scalable product, as long as I subscribe and pay for the application I wish to use. It is scalable, and for about one and a half years, I have experienced no challenges in this area. I have not even needed support after deployment, since it has remained stable.

When creating a ticket for support during deployment, the response is satisfactory, though the gaps in enablement and lab sessions are clear. Overall, I would rate support around an eight or nine, and my overall experience with security products spans around four years, with my particular engagement with Imperva Application Security Platform mainly during project deployment and client training.

Positive

For installation, it primarily involves a cloud-based service, and I was using that as an operator. For database activity monitoring, I have deployed it, and while it is somewhat complex, there is a support channel where I communicate with vendors to resolve issues. The main challenge during installation is not unique to Imperva Application Security Platform. It is faced by many on-prem and virtual appliance products, particularly ensuring integrity with the virtualization environment and integration with third-party applications.

I am not using CyberArk, as it is only a proposal for identity and access management that I have proposed for my clients.

Apart from One Identity, I am working with SentinelOne for AI, and I was looking for that. For Purple AI, I was communicating with the vendors and the distributor, and I have considered proposing it for my clients. Currently, I am using the load balancer Radware as an application load balancer. For the on-prem WAF, I am using Fortinet, regarding the WAF and the load balancer, Radware and Fortinet.

I am not working with some email security products, some EDR, or endpoint protection as an implementation. I was just looking into it and have proposed it for my clients, and I am waiting for the financial evaluation for FortiMail. For Fortinet, I am involved more with FortiMail, WAF, ADC, FortiGate firewall, NAC, WAF, and FortiClient EMS.

Regarding Check Point and WatchGuard, I have worked with Check Point for the firewall, specifically the perimeter firewall. For Check Point, I have already worked with the firewall only, which is a next-generation firewall, using a physical appliance on-prem. Most of my customers, particularly financial institutions, even if they invest their resources in the cloud, need an on-prem solution. It could be a virtual appliance deployed on a server or a physical appliance, but they mostly need on-prem.

Regarding the price, I find Imperva Application Security Platform affordable, with moderate pricing. My overall rating for this solution is eight out of ten.

Currently in my present company, we do not use Imperva Application Security Platform. However, during my co-op position, we used it as part of a web application firewall. I cannot provide a specific example since I cannot disclose any information, but we used it for daily operations to check the traffic, the attack, and the impact of any external traffic occurring on our websites.

The most helpful feature of Imperva Application Security Platform that we have been using is the dashboard, especially the alerts and the traffic reporting. We used it to provide a specific report and summary of what we saw on the specific website, specific attacks, and specific activities or events that were unusual or common. This allowed us to know if we needed to investigate something or if it was just a common occurrence.

Imperva Application Security Platform did improve our efficiency, especially during calls and meetings. We could provide a specific summary of reporting that we could share with the board or stakeholders to show what we saw every single day and what we were dealing with. They could see the clearer picture and bigger picture of what we were dealing with every single day, especially in terms of Imperva or the web application platform.

Based on the reporting that Imperva Application Security Platform provided us, it really did help save time. We were able to provide summarized reports, especially to the VP of the cyber security department who is not into the more technical aspects and wants to have a clearer picture through graphs. Imperva was able to provide specific graphs for each day. We could show him that there was a spike specifically for this website, and he could ask what about the other days and other times, and we could clearly show it to him. This gave him a clearer idea of the traffic or the incidents we were dealing with related to Imperva.

I ran into some false positives with Imperva Application Security Platform, but I think that was because of our configuration and the company's configuration. However, the majority of the time, it was accurate. We saw the unusual events, the amount of traffic that was going on, and the websites that we needed to focus on more, or the specific websites we needed to monitor rather than other websites, because those were the common websites that received specific alerts, specific incidents, or events.

Based on what I have seen and used during that time, Imperva Application Security Platform was very easy to use. I was satisfied with how I used it before, so I do not have anything else to add about the features.

Based on my experience with Imperva Application Security Platform, there were some missing features when it comes to details in the alerting. Sometimes I was not sure if that was the configuration of our company or a vendor issue. Based on what I heard, it is good, and based on what I used, it is good. I think overall it is a great product.

Regarding improvements in terms of integration with Imperva Application Security Platform, perhaps it could be integrated into the SIEM, though I am not certain about this.

I have been using Imperva Application Security Platform ever since I started my co-op, but I was very familiar with Imperva from 2020 when I worked at a different company. I am not really sure how to accumulate that time or the exact month, but I have been working with it for quite some time.

There are times that I noticed when I was getting reports at a specific time, maybe a month or two, that Imperva Application Security Platform gets laggy and sometimes it goes to the point where it does not load and you have to restart it. I was not sure if it was us or a part of Imperva's issue.

There are times that we experienced downtime or crashes with Imperva Application Security Platform. I think this happened when the company, because I worked with Cineplex, experienced times where traffic went really strong or fast because people tried to get tickets. There were times that it crashed, it did not load, and we had to wait until it was fine.

Based on what I experienced with Imperva Application Security Platform, there were times that it reached the limit. When I tried to extract specific events from two months, it crashed. Sometimes it did not load and I had to repeat it multiple times just to get the specific or accurate report on that specific time frame.

I experienced something when I was working with the company, but it was not me who reached out to customer support for Imperva Application Security Platform. One of my colleagues reached out and they said it takes time. The customer support is fine, but the requests they were asking for took too much time, which slowed us down in terms of operations.

Based on what I heard, the initial setup of Imperva Application Security Platform was very straightforward. When I came to the company, it was already there, so I think it was very straightforward and very easy for the team because I did not see or hear any issues with them discussing this.

I am not sure about the cost since Imperva Application Security Platform was already there when I arrived. However, based on what I have heard, observed, and seen, they are doing fine. The licensing is fine, the pricing is fine. Based on what I heard, they just had their contract extension, so I guess it is fine.

Here at the company that I used, I have never heard of other solutions being used. However, I think I worked with AWS WAF before and also with Cloudflare. If I heard correctly, the company did try other solutions. I think they came from Cloudflare and also tried AWS. I think they also tried evaluating Fortinet.

Based on what I observed when I used Imperva Application Security Platform, it is very useful and the features are great. It is very helpful in terms of operations. There are flaws, and I mean there is no perfect platform, but I can recommend Imperva Application Security Platform to my colleagues and other people because it is a very good product. Imperva Application Security Platform is one of the good tools I have used ever since I started working. My review rating for this product is 9 out of 10.

Hybrid Cloud

Other

My main use case for Imperva Application Security Platform is protecting public-facing websites, and I primarily used Imperva for the web application firewall, which was the principal use case for us.

I recall a time when Imperva's Web Application Firewall helped us detect threats and protect against specific attacks. We used it in a large banking group to avoid and detect threats and protect against OWASP Top 10 vulnerabilities in web application security. This helped us significantly in detecting those vulnerabilities while using custom rules in WAF, making it a very effective use case for our web applications.

In addition to that, we were using Imperva WAF for bot detection and DDoS attacks. We tweaked the firewall rules and added rate-limiting rules to help manage DDoS attacks to a certain level.

What I found most effective about Imperva's WAF is that it has predefined rules covering many use cases, including compliance rules for PCI DSS and local country compliance. The customized rules based on application threats proved to be very useful, along with a good dashboard that, although somewhat complicated for beginners, becomes easy to manage at an expert level with good API integration and effective threat intelligence to detect threats.

After discussing the WAF, I believe Imperva has made significant advancements in its Cloud WAF offerings, which can now effectively protect against bot and DDoS attacks. This showcases a good advantage of being part of the Thales cybersecurity group while expanding its product range in the Cloud WAF space.

Imperva Application Security Platform has positively impacted my organization by providing strong protection for web applications, as many big companies in the UK use Imperva WAF as an essential protection layer, illustrating its effectiveness.

To improve Imperva Application Security Platform, there is a necessity for enhancement in the threat layer, especially regarding DDoS protection and geographical DDoS attacks. Additionally, there is a need for more API integration within the environment, indicating room for improvement in those areas.

I rate this product eight out of ten because I believe there can still be improvements for the WAF, especially in terms of custom rules. I suggest that more rules could be added to the system instead of relying on SMEs for customization. The hardware being more expensive compared to other vendors poses a challenge, along with a need for improvement in the cloud WAF offerings.

I have been using Imperva Application Security Platform for nearly five to six years. I first used it in a large banking group before I joined my current company, where I used both the Imperva on-premise devices and Imperva Cloud.

In my experience, Imperva Application Security Platform is stable.

Regarding scalability, it is good in the cloud but not very strong for on-premise installations.

The customer support from Imperva has been great, with a single point of contact who catered to our company's needs effectively.

We did not use a different solution before adopting Imperva Application Security Platform.

We purchased Imperva Application Security Platform through a partner.

Although it is difficult to quantify the return on investment in monetary terms given that we cannot translate threats into monetary values, the use of Imperva was driven by compliance reasons and resulted in fewer incidents.

My experience with pricing, setup costs, and licensing has shown that the setup cost was high, with the hardware installation in the data center being particularly expensive. Additionally, the cost associated with the appliances used to load balance application traffic resulted in expensive licensing and a need for frequent license rotation. Configuring both hardware and software has also proven to be time-consuming and costly.

Before choosing Imperva Application Security Platform, we evaluated F5 as a WAF solution and also considered Cloudflare.

Although it is difficult to measure the success in commercial or monetary terms, we found that we could manage more threats within the environment, with Imperva flagging threats coming from the internet, resulting in few incidents. This illustrates how Imperva helped us.

I would highly recommend others to consider using Imperva Application Security Platform, and I rate this product eight out of ten.

On-premises

Other

My main use case for Imperva Application Security Platform is to block unauthorized IPs, users, and source applications, as we configured the Web Application Firewall to monitor internet-based applications during my previous project.

To decide which policies to configure for blocking unauthorized users and sources, we identify authorized users and source IP addresses, ensuring only those belonging to the organization are validated and whitelisted in Imperva Application Security Platform to effectively block unauthorized sources. Imperva Application Security Platform works on a whitelisting concept, meaning only whitelisted users are allowed while others are treated as unauthorized.

We implement multiple policies for sensitive data in the Web Application Firewall because users may attempt to access sensitive health-related information. In a healthcare project, we set up patterns to alert if sensitive data is accessed within the organization and block it if accessed externally.

The best features of Imperva Application Security Platform include its ease of use, as it offers both on-premises and cloud options, with minimal maintenance downtime during patching due to the recommended three gateways setup, allowing for resource monitoring while upgrading.

Imperva Application Security Platform positively impacts my organization by reducing CVE-related issues significantly, as we monitor and learn from reports generated during collaboration with respective teams.

We track the reduction in CVE-related issues through weekly and monthly meetings using Imperva Application Security Platform reports. Initially, there were over 1,500 vulnerabilities, but we managed to fix almost all of them within three months, leaving only two low severity issues outstanding.

Imperva Application Security Platform can be improved as it currently lacks integration with other tools under the Data Security Fabric, particularly the WAF feature, which would enhance overall functionality.

Generally, I am satisfied with the user experience of Imperva Application Security Platform; however, I would suggest streamlining the patching process for larger environments as it becomes time-consuming when applying multiple patches across many gateways.

I have been working in IT security for 10 years out of my overall 17 plus years of experience.

Imperva Application Security Platform is always stable, having encountered issues infrequently across my usage of their products.

The scalability of Imperva Application Security Platform is indeed good, effectively accommodating growth for larger organizations despite internal data management policies.

Imperva Application Security Platform handles scalability effectively, allowing for growth when appropriately understood through policies and configurations, although understanding the platform takes time.

Customer support from Imperva has been very good as I have raised over 100 cases, with responsive support addressing urgent needs, even offering early support despite initial SLA challenges.

We did not previously use a different solution, starting with DAM and moving directly into a full implementation due to an incident that required rapid deployment.

We utilized AWS for our private cloud environment, finding it satisfactory, although I only used Imperva Application Security Platform Cloud once for DAM, not WAF.

While I would not say we have saved money, we have certainly saved time through effective documentation and support for compliance-related issues, streamlining the necessary processes with fewer employees.

We faced challenges with high costs, as the customer perceived pricing for gateways to be excessive, but we handled multiple billing instances with sophisticated setups.

We did not evaluate other options before choosing Imperva Application Security Platform, opting for it directly because it fit our needs for an on-premises solution.

Beyond the WAF, Imperva DAM is beneficial because it features Imperva Security Fabric and Data Security Fabric, including tools like File Access Activity Monitoring, though the WAF is still using previous functionalities.

I can confirm that Imperva Application Security Platform is stable, though we have not purchased Imperva Application Security Platform cloud environment from the AWS Marketplace.

It is important to decide the purpose for using Imperva Application Security Platform; I recommend it for monitoring internet-based applications, while for internal tasks, it may not be worthwhile due to its costs. I would rate this review as a 9.

Private Cloud

Amazon Web Services (AWS)

My main use case for Imperva Application Security Platform is the Web Application Firewall, which I use for firewall protection and monitoring 24/7 for suspicious activity.

Regarding my main use case, I first log into the WAF applications, then access the Alerts section. In that section, I can see different types of activity happening in the firewall. I review each alert to determine whether it is legitimate or suspicious activity. I can also view the target IP address and locations, target servers, and the payload that the attacker was using in that alert. I can see the OWASP Top 10 alerts and the event timing to identify when the attack occurred.

Imperva Application Security Platform offers impressive features. I am using the WAF, which blocks each alert based on signature-based attacks. That is the most impressive aspect I have experienced.

There are many alerts in Imperva Application Security Platform. For example, there is an OWASP Top 10 alert called SSRF, which is server-side request forgery. If someone attempts to access the server, the WAF blocks that SSRF alert, or RCE, Remote Code Execution alert, blocking immediately based on the signature, not only by the payload or the IP address. That is very effective.

Imperva Application Security Platform has positively impacted my organization because every time an attacker uses a malicious payload or malicious signature that is already included in the signature database of the WAF application or Imperva application, the application directly blocks that particular signature immediately. This capability can help any organization achieve better security outcomes.

I believe Imperva Application Security Platform can be improved because cybersecurity is a field that changes every day, and different types of signatures are being invented. The WAF team should add more signatures, including basic and advanced signatures, on a daily basis. They need to understand this requirement and update their signature database daily.

I have been using Imperva Application Security Platform for almost one year and four months.

Imperva Application Security Platform is stable.

The customer support for Imperva Application Security Platform is very good.

I did not previously use a different solution; I have been using the WAF Imperva application for the last five years.

Imperva Application Security Platform has helped reduce incidents, save time, and improve my organization's security posture with specific measurable outcomes and metrics.

I would rate Imperva Application Security Platform a 10 on a scale of one to 10.

I gave it a 10 because it is useful for private organizations and it is very safe to have WAF applications, particularly Imperva Application Security Platform.

The advice I would give to others looking into using Imperva Application Security Platform is that it is safer to use or to have it. My overall rating for this product is 10 out of 10.

My main use case for Imperva Application Security Platform includes DDoS, cross-site scripting, and SQL injections. This kind of signatures will be detected and blocked by Imperva Application Security Platform.

I used Imperva Application Security Platform to check a particular target and verify what action was taken by Imperva Application Security Platform on multiple bad requests, whether they were suspended, allowed, or blocked. The decision making regarding what is taken by Imperva Application Security Platform, I used to check in the tool. I can conclude that whether it is impactful or not on the target and take a decision to follow the further incident response plan.

I interact with Imperva Application Security Platform by checking the action taken by Imperva Application Security Platform and also configuring the rules. It effectively works on blocking according to the rules we specify. It is the best tool for detection and mitigation of current web-related attacks.

In my experience, the best features of Imperva Application Security Platform include blocking malicious requests and checking the status of those requests. Each and every detail taken by Imperva Application Security Platform, I can note down, and I can take decisions.

The level of detail in the status reports from Imperva Application Security Platform is one hundred percent helpful for my work.

Imperva Application Security Platform positively impacts my organization by helping to mitigate web-related attacks. Our clients' web applications are kept very secure and safe.

As per my knowledge, everything regarding Imperva Application Security Platform is okay, but I do not have that much level to explain the improvement part. As per my best knowledge, it is a wonderful tool as of now, and nothing major changes are required.

Maybe regular updates that evolve with current situations and integrate with a threat intel base, allowing automatic blocking of the IOCs, could be beneficial.

I have been using Imperva Application Security Platform for three years.

Imperva Application Security Platform is stable in my experience.

The scalability of Imperva Application Security Platform is pretty much scalable, and it can be used in any environment. It is a very scalable tool.

My experience with Imperva's customer support is that it is very great; they react in a timely manner, so it is good.

Previously, I used Akamai, but Akamai is difficult to navigate and check the operations. Whereas Imperva Application Security Platform gives precise and concise information about things, so it is a much better tool when compared to Akamai.

I have seen a return on investment because it saves money and time as it automatically takes decisions on IOCs and blocks them immediately, which helps us mitigate the IOCs before they exploit the vulnerabilities.

My experience with pricing, setup cost, and licensing of Imperva Application Security Platform shows that they are very affordable and also very helpful and needful for the organization. It is a great offer.

I did not evaluate other options before choosing Imperva Application Security Platform because it is the best one currently in the market.

I have not seen anything major in terms of specific outcomes or measurable improvements, but it is already taking decisions very effectively and blocking malicious requests, and also helps us gather information about the IOCs and block them in the end. It is a very useful tool for organizations, and I suggest every organization use it.

Imperva Application Security Platform is deployed in my organization in both on-premises and public and private cloud environments.

I would rate Imperva Application Security Platform a ten out of ten because in our environment, it is just a perfect tool. I do not know about the other environments. I give this rating of ten out of ten to Imperva Application Security Platform.

Hybrid Cloud

Amazon Web Services (AWS)

My main use case for Imperva Application Security Platform is for WAF, application firewall, which is a web application firewall. I have my company's sites, websites, and our core application runs on it as well, so all traffic must first come through Imperva Application Security Platform before it's routed to the application.

A specific example of how I use Imperva Application Security Platform for my core application involves dealing with all the unwanted bots on the internet and crawlers.

Regarding my main use case with Imperva Application Security Platform, it denies all forms of malicious attempts to the sites, including SQL injection, brute force attack, DDoS, and all of that. It denies that and provides information about it through logs that indicate which particular IP was denied and the region, so I have the location based on the IP. I can get the location of where the attacks or injections are coming from. Basically, I receive a clean request based on the rules I've set, made to the server, and then receive their request back, while the ones that are not clean are blocked.

Regarding other features, Imperva Application Security Platform has safe logging capability and, as mentioned earlier, it's primarily for my WAF, web application firewall. Any basic web filtering capabilities are there, and that's all I use it for.

The best features Imperva Application Security Platform offers include DDoS protection, anti-DDoS capabilities, and connection protection against different malicious web attacks.

Imperva Application Security Platform has positively impacted my organization, as before its introduction, I usually had a lot of logs on my router, with many foreign attempts from anonymous IPs trying to gain access, including a lot of brute force logs. The CPU of the router would struggle with what it wasn't supposed to be doing while legitimate users suffered. Since implementing Imperva Application Security Platform WAF, as mentioned earlier, only legitimate traffic reaches the server and the router to request what they need, and of course, the response is given. This allows us to accommodate more legitimate traffic, faster and more securely.

While I can't provide a specific metric at this moment as I'm not in front of my system, I can confidently say that we have significantly noticed improved performance in terms of latency, an increased number of requests we can handle, and a reduction in attack attempts.

One improvement I would like to see in Imperva Application Security Platform is the ability to fail over to different sites for my same application. I want to have my disaster recovery site, my current site, and my cloud environment, all different, about three sites so that I can load balance across those sites. It would be beneficial if that could be included as a baseline feature without needing a special license.

I also think about the ability of Imperva Application Security Platform to integrate its logs with various systems; the integration with SIEM solutions is limited to certain types of OEM. I would prefer a situation where they are more agnostic in terms of log integration with SIEM solutions, such as SentinelOne.

I have been using Imperva Application Security Platform for more than three years.

Imperva Application Security Platform is very stable.

In terms of scalability, I believe it's within their infrastructure; there has never been any downtime.

I use the channel partner for support and have never had a need to raise a ticket directly with Imperva.

Imperva Application Security Platform is deployed in a cloud solution, as I was provided with login details, logged in, and configured Imperva Application Security Platform, putting in my public IP. From Imperva, I received a certain CNAME that I placed in my DNS, so all traffic coming to my domain goes through that DNS, through the CNAME to Imperva Application Security Platform, and then Imperva Application Security Platform forwards it to my public IP. Therefore, I would classify it as a private cloud.

I have the impression that there is a return on investment; we enjoy cleaner traffic in our environment, and more requests are being served, indicating a huge return on investment.

My experience with the pricing, setup cost, and licensing is that the pricing is not transparent to me; it's what the vendors give, or whatever the channel partner offers that you can negotiate on. The setup process is pretty easy, and the vendor is very transparent in terms of support.

Prior to choosing Imperva Application Security Platform, I did not evaluate other options in terms of a proof of concept; I only did a feedback assessment on the internet.

I would rate Imperva Application Security Platform a nine on a scale of one to ten. I choose a nine because it has not failed me since I've been using it, and I've not had any attack. My advice to others looking into using Imperva Application Security Platform is that it is highly recommended and certainly worth trying out, at least for web application firewall purposes.

Private Cloud

Other