Imperva Application Security Platform Reviews

• Web security
• Protection against DDoS
• Easy to use administration portal
• Reports
• It’s simple to configure
• Very effective
• Easy solution to administer for protecting websites of all sizes

Any website that we publish on the web needs to be fully protected. In hosting environments, installing an on-premise WAF solution or other security device is not feasible. Incapsula provides a very simple to install and configure solution, that can be up and running in minutes. Also, now, we don’t have to worry about the security of the website, or if the bandwidth needs to be increased, as everything is automatic.

It would be nice to have a mobile app as a dashboard interface instead of the web administration, but the service is really great. The product is the best at what it does.

I've used it for three years.

Once the DNS configuration is done, everything works flawlessly.

No issues encountered.

No - in a large scale attack, the protection scaled without problem.

Service is good and prompt, 9/10.

I haven’t had much need for tech support.

We previously used Cloudflare. Although a very good solution, it forces users to completely give up the DNS management of their domain, which most enterprises don’t want to do. Incapsula only needs a redirection of the actual web entry.

Very straightforward. The default settings work very well and are running within minutes. Configuration of advanced features is simple and fast.

Through our own in-house team.

It’s difficult to measure, but without Incapsula, we would be forced to host the website on-premises, with very high costs. ROI is probably within six months.

Setup cost was zero. Annual cost is $7,200.

We evaluated Cloudflare as well.

This is very simple to install. Websites that use SSL should pre-export their certificates and be ready to import them into Incapsula.

• Human contact
• Fast SLA
• Trustworthy and excellent communication

Highly-functional back office with user friendly reports and intelligence on bad IPS and malicious software is at very high level and very quick. Part of the solutions function is that they have to stay on top of the data intelligence game. They have the first knowledge of break points.

The product makes information readily available and mitigates any problems quickly.

With the way that protection works, there is no such thing as pure protection, but as soon as Incapsula knows what a problem looks like, they fix it. They have to stay on top of the data intelligence game.

I've used it for three years.

It's usually fast but it can take two to three days on a big operation to get it live, especially if there is tracking.

No problem with scalability.

Communication declined a bit as they got bigger – 7/10. Service is really good though.

8/10. Service is good.

We went through at least a quarter million dollars in DDoS firewalls before we got to them. We tried solutions worldwide.

For enterprise level stuff pricing is very competitive. Very good corporate deals.

Go for it if you’re looking into it – they are a good solution and are trustworthy people. Just really works.

• DDOS defence
• Load balancing
• Security role

The availability of our sites, thanks to the load balance functionality, has improved. It enables the site to be available all the time, despite people trying to attack it.

More features to help fine tune it. In general, more features for the platform would be nice.

I’ve used it for two to three years.

I used the customer service once.

Once or twice, there has been downtime, but it was only a matter of minutes.

No issues encountered.

It was pretty high quality service. They guarantee to fix your problem within 15 minutes, but they don’t always keep their word.

They are professional people who provide solutions.

No previous solution used.

It was very simple.

It was done in-house.

The price is between $5,000 and $10,000.

The product experience is really easy, therefore you should go and experience it.

Their WAS - I had a problem and I turned to Incapsula. I needed someone to protect the website and they succeeded in this regard.

We’re not an e-commerce site, but a website for providing information, and we needed someone to protect the website. The user-generated spam stopped after we started using Incapsula, and so we feel more secure.

I needed some support and according to the SLA and I couldn’t get telephone support and it took a little while till they got back to me. We’re an enterprise company so I think I would be happier for a bit more support to pick the phone up and ask a question. There was not as much back office help as we would have liked.

I’ve used it for four months.

Yes, we had some down time but we solved it. It took us a few hours although we were promised no down time.

No issues with stability, but I still have to look into whether the site speed was faster than it was before as promised.

No issues with scalability.

8/10 – very professional.

8/10 – very professional once they got back to me.

I didn’t use any other solution.

It’s not costly for my needs.

I knew the solutions available in the market because I was working in a cyber-security company. I suggested the product, because I knew the product and that they are better than other solutions for my needs.

Do it on a Sunday in case there is down time. I would ask for support after implementation, and check that the site speed is as fast as it should be.

The Web Application firewall is a valuable feature as the security features are mostly what we're interested in.

We hope that the product helps protect us from potential threats, hackers etc. that compromise our website and services. We want peace of mind. The fact that nothing has occurred is a good thing.

We’ve had a few, short outages that didn't have an impact on the business. One outage lasted a couple of hours, so the reliability could be improved.

At times, we can prove the service is not running, but technical support doesn’t reflect that fact. We appreciate that nothing is 100% reliable, but we'd appreciate more information during an outage and not after the fact.

Also, reporting could be improved. We shouldn’t have to look on Twitter to see if others are experiencing a similar issue. Greater transparency is needed when there is an issue.

I've used it for about two years.

No issues at all.

We have had a few outages.

No issues on that front as we haven’t needed to scale it.

Average to poor.

Average to poor.

Yes, we used Barracuda. The product was not difficult to configure but it didn’t work well. There was high latency in the product.

It was straightforward.

Cost is OK. It’s more expensive than CloudFlare and Amazon but it’s got better features. We are happy with the price, its just the information and reliability, otherwise we would be happy to give a glowing recommendation.

We looked at CloudFlare, but they don’t offer the same security features. Incapsula was selected because of the uniqueness of the security features.

I think it’s a leading product, a market leader; that’s how it feels to us. But I don’t think it would be a good product if i'ts mission critical. You'd need to proceed with a certain amount of caution because we haven’t had 100% uptime.

I really like the profiling section. I mean that signature based policies are ok and they are maybe the most widespread and common kind of security policy in security appliances, but, the profiling policies are custom tailored on a specific web application. I guess it’s the most valuable, and fresh, aspect about SecureSphere.

It has helped a lot with working among, and creating a link between, different teams in my organization, of course I’m referring to security, networking and system application teams. It’s important to find the right collaboration in order to secure the applications from the beginning of the deployment process.

I guess the GUI could be improved a little, as it’s not always simple to get. The most important aspect to me that needs improvement though, is that, by default, if you put activate and protect a server group you created, all the web applications lying on the same group of physical machines, inherit the same policy rule set. This means it’s not so easy to different policies and cut them on a specific application (maybe I’ll ask the vendor support).

It’s been one-and-a-half years.

Not in particular, once I understand the network behavior and the different types of the WAF deployment it was pretty simple and fast.

Not so far. It must be said, though, that It’s a relatively a new installment in our infrastructure, and maybe it’s too soon to say.

It’s an ongoing process day to day, working alongside systems and application engineers to adapt the WAF to better meet the applications characteristics. I guess it depends a lot on the application features and software implementation.

I would say that they are pretty available.

They are reliable and ready to solve your issues.

To be honest, we have been supported by a professional services engineer who showed us the peculiarities during the initial setup, so it was a good experience. I would say that it’s straightforward if you are in good hands.

I would say to focus on the most convenient area for positioning the WAF in order to take the get the best out of it. In my case, we chose a WAF appliance, and it’s crucial where to put it. For instance, we chose to deploy it downstream from the load balancing network infrastructure for various reasons. One of them was to enable the WAF to see the private IP addresses that a vulnerability assessment tool in the private DMZ would see in order to use the WAF as an application firewall and as a virtual patching tool either.

I was involved in the deployment and found that all the features in this product are fantastic, especially the correlated attack validation, threat radar (reputation, fraud), and virtual patching. Those are features that are very useful in day to day operations.

Using WAF in an organization means we can quickly see the attacks that the environment is suffering and take action to mitigate the threat(s). It is possible to view traffic and analyze it to determine if it is legitimate traffic or not, using features such as threat radar and geolocation, helping the security team in the company.

I've been using the WAF component for over a year.

I had no issues with deployment.

I had no issues with stability.

I had no issues with scalability.

I didn't use the customer service, but all the teams in Imperva have a deep knowledge about the product to support customers for any issues they have.

The technical support team at Imperva have a deep knowledge of all their solutions, and they are ready to support any customer with any problem.

The initial setup is different for each environment. You need knowledge of the environment and application, to make a good schedule of activities. Make sure you validate the requirements, and the setup will be simpler to do

I work as a System Engineer and part of my role is to help the partners do deployments for our customers. I participated in some deployments, and I can say the partners I have worked with have good knowledge about deployment and support for all solutions.

All products are good, and I believe narrowing the choice of manufacturer is best done when you do proof of concepts in-house and you can see which of your choices is best matched to your needs.