Source: securityboulevard.com – Author: David Holmes
Forrester just published its 2025 Web application Firewall Wave. As a former industry analyst, and as a contributor on the vendor side for Imperva (cough, a leader in the report, cough), let me share some reactions on the shape of this report.
The Center of the Universe
The first top level header (H1 in the industry parlance) of the report asserts that the WAF has become ”The Center Of Application Protection Suites.” I absolutely agree with this statement, and have been saying this myself for years. The WAF is similar to the Network Firewall (I used to cover that space) in that, no matter how many times it is pronounced DOA, it just keeps growing and absorbing any adjacent technologies. The network firewall did this with similar inspection controls like IDS/IPS and malware detonation. The WAF has done it with bot management and now API security. For the curious, why doesn’t the Network Firewall absorb the WAF? Most of the time WAF is in a B2C environment, not an enterprise environment. Different use cases, threat surface, buyers, partners, security policy, etc. The B2C WAF is largely safe from the Network Firewall, and other enterprise-focused tools like CWPP and CNAPP. Even in the cases WAFs are used in enterprise environments, the problem space is just too big to be collapsed into a network firewall (think bot management, DDoS protection, SSL decryption, API security, etc).
Efficacy vs Operational Efficiency
A top consideration for buying a WAF, according to the report, is to consider its efficacy in both terms of false positives and false negatives. The former adds friction, which is poison in the B2C world, and the latter erodes effectiveness and generates mistrust to the security team. My reaction: this is also spot on. One of the challenges of the conventional WAF is policy management and “tuning” to avoid false positives. Constant tuning, when not done, is technical debt. We have many competitors where 90% of their customers never put their WAF in blocking mode, because of too many false positives. Imperva’s approach to the cloud WAF is “just let us do the work for you.” Over 96% of Imperva Cloud WAF customers just onboard their application and let us handle the day-to-day policy changes. That’s what makes us different, and, we think, contributed to our top score in the “Adoption” criteria of the evaluation.
API Ready or just API Curious?
An astute reader of the evaluation will notice that one of the first criteria is API discovery and protection. Most customers know that they have exposure here (and want to know their risk). The API security market is growing over 20% YoY! There are still a few standalone API sec solutions out there, but by and large API security has become a function of the standard AppSec stack. Consider this: all serious API security solutions operate asynchronously (not inline). When it’s finally time remediate, what component is going to do the blocking? In most cases it will be the WAF, since it’s already there. What about API gateways, some might ask. Great question, but the security team doesn’t own that component and would have to regularly negotiate with its owners for policy blocking. Siloed security teams are still a reality, so many are already looking for a security-team-only detection and response option.
Magecarts and Client Side Protection
The release of this report on Web Application firewalls is super timely because (here’s your last reminder): the PCI DSS 4.0 deadline to have client-side protection (CSP) against magecart attacks is in just a few weeks! In my conversations with customers, it is a matter of urgency and this report can help generate shorter shortlists for shoppers. For example, none of the current hyperscaler WAFs have CSP, but of course, we do. Props to Forrester for including an explicit mention of CSP in our vendor scorecard, we do appreciate it.
As a leader in this report, we are of course licensing it for you and you can access a copy of it, and read more about the importance of industry analyst reports, at our launch blog here.
Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. For more information, read about Forrester’s objectivity here.
The post The 2025 WAF Wave from the Other Side appeared first on Blog.
*** This is a Security Bloggers Network syndicated blog from Blog authored by David Holmes. Read the original post at: https://www.imperva.com/blog/the-2025-waf-wave-from-the-other-side/
Original Post URL: https://securityboulevard.com/2025/03/the-2025-waf-wave-from-the-other-side/?utm_source=rss&utm_medium=rss&utm_campaign=the-2025-waf-wave-from-the-other-side
Category & Tags: Application Security,Security Bloggers Network,Forrester Research,Imperva Cloud WAF – Application Security,Security Bloggers Network,Forrester Research,Imperva Cloud WAF
Views: 2
