Executive summary
As of November 2026, CybersecTools tracks 303 companies that sell application security solutions as their main business. Cloud Web Application and API Protection is part of that family. The largest groups are based in the United States, Israel and the United Kingdom. In the last 12 months they raised $1.3B across 53 funding rounds, 14 companies were acquired and 40 new companies started in the last two years.
From that field we chose six solutions that sit in front of your websites and APIs to block web attacks, bad bots and floods of traffic. Cloudflare suits teams that want protection on a global network with little upkeep. Akamai fits large companies that want a web firewall, bot controls and API discovery at the edge. Imperva suits regulated teams, such as banks, that want managed rules with daily updates.
The main choice is how much the vendor runs for you. Some products are mostly self-service, while others include a managed service or a 24/7 security team.
Ask how each product handles API discovery and bot control, not only classic web attacks. Then test it on your own traffic in monitor mode before you block.
How we evaluated
We looked at 53 cloud web application and API protection solutions from 35 companies, and the 6 on this page made the cut. We combined our judgment from years of leading enterprise security programs with market data from Mandos, our market intelligence platform, and with the vendor and review pages listed under Sources at the end of this page. For customer feedback, we left out paid reviews, reviews by vendor staff or partners, review campaigns and anything older than two years, so you get an accurate view of what customers say.
Four traits mattered most: blocking common web attacks without breaking real traffic; bot and API protection, not only classic WAF rules; DDoS defense built in; and logs that reach your SIEM. We left out on-premises-only appliances, load balancers, and firewalls that work inside only one cloud provider. The order follows how widely each product is used by teams like yours. Company momentum shows how the vendor itself is growing, so a market leader can rank first with a lower score.
Read the full method · See all sources
What is Cloud Web Application and API Protection
Cloud WAAP stands for web application and API protection delivered as a cloud service. It combines a web application firewall (WAF) with bot management, API protection and DDoS defense. Your traffic passes through the vendor's network, which blocks attacks such as SQL injection, cross-site scripting and credential stuffing before they reach your servers.
For you, this matters because your public websites and APIs face attacks every day. A single flaw in a web app can expose customer data. Bots can scrape prices, test stolen passwords or flood a login page. A cloud WAAP blocks most of this before it reaches you, and it updates its rules as new attacks appear.
Compare Cloud Web Application and API Protection solutions
This analysis focuses on six cloud WAAP solutions. The table compares them on vendor, who each one is best for, deployment model and the NIST CSF functions they cover.
- 1.
Cloudflare WAF
Best for: Teams wanting global protection with little upkeep
Starting price: Free plan. Paid plans: contact sales
Cloud · Startup to Enterprise · NIST: Protect, Detect
- 2.
Akamai App & API Protector
Best for: Large companies wanting edge protection plus API discovery
Starting price: Contact sales
Hybrid · SMB to Enterprise · NIST: Protect, Detect
- 3.
Imperva Web Application Firewall (WAF)
Best for: Regulated teams wanting managed rules, such as banks
Starting price: Contact sales
Hybrid · SMB to Enterprise · NIST: Protect, Detect
- 4.
F5 WAF for Distributed Cloud
Best for: Teams running apps across many clouds
Starting price: Contact sales
Hybrid · SMB to Enterprise · NIST: Protect, Detect
- 5.
Fortinet FortiWeb
Best for: Teams already running Fortinet security
Starting price: Contact sales
Hybrid · SMB to Enterprise · NIST: Protect, Detect
- 6.
Wallarm Cloud-Native WAAP
Best for: API-heavy teams that want web, API and bot protection in one engine
Starting price: Contact sales
Hybrid · SMB to Enterprise · NIST: Protect, Detect, Respond
| Solution | Best for | Starting price | Deployment | Company size | NIST CSF functions |
|---|---|---|---|---|---|
| Teams wanting global protection with little upkeep | Free plan. Paid plans: contact sales | Cloud | Startup to Enterprise | Protect, Detect |
| Large companies wanting edge protection plus API discovery | Contact sales | Hybrid | SMB to Enterprise | Protect, Detect |
| Regulated teams wanting managed rules, such as banks | Contact sales | Hybrid | SMB to Enterprise | Protect, Detect |
| Teams running apps across many clouds | Contact sales | Hybrid | SMB to Enterprise | Protect, Detect |
| Teams already running Fortinet security | Contact sales | Hybrid | SMB to Enterprise | Protect, Detect |
| API-heavy teams that want web, API and bot protection in one engine | Contact sales | Hybrid | SMB to Enterprise | Protect, Detect, Respond |
Vendors change prices, so check before you buy.
See every Cloud Web Application and API Protection solution we list
The full Cloud Web Application and API Protection market, filtered by company size, deployment and NIST coverage.
A cloud-based web application firewall that protects applications from various cyber threats through rule-based filtering, machine learning detection, and integrated security features.
San Francisco, United StatesFounded 2009Public company
- SOC 2
- ISO 27001
- ISO 27017
- ISO 27018
- FedRAMP
- PCI DSS
Best for: Teams wanting global protection with little upkeep
At a glance
- Vendor
- Cloudflare, Inc.
- Headquarters
- San Francisco, United States
- Founded
- 2009
- Ownership
- Public company (NET)
- Deployment
- Cloud
- Company size
- Startup, SMB, Mid-Market, Enterprise
- NIST CSF
- Protect, Detect
- Starting price
- Free plan. Paid plans: contact sales
Funding, hiring and news for Cloudflare, Inc. on Mandos.
Our take
Cloudflare WAF runs on Cloudflare's global network and checks every request before it reaches your app. It covers the OWASP Top 10 with managed rules, uses machine learning to spot new attacks, and adds rate limiting, exposed credential checks, uploaded file scanning and bot mitigation. You can write custom rules in a dashboard or with Terraform.
It sends logs to Splunk, Datadog, Elastic, IBM QRadar, Sumo Logic, Amazon S3 and Google BigQuery.
It earns its place because the firewall, bot controls and rate limiting all run as one cloud service, so you protect a site by routing its traffic through the network instead of running your own gear. It fits any size, from startups to enterprises. The question to weigh is whether you are comfortable sending all your web traffic through one provider.
Cloudflare WAF main features
- Managed rulesets
- Custom rulesets
- OWASP Top 10 rules
- Machine learning-based detection
- Advanced rate limiting
- Exposed credential checks
- Uploaded content scanning
- Bot mitigation
Cloudflare WAF main integrations
- Amazon S3
- Datadog
- Elastic
- Google Cloud Storage
- Google BigQuery
- Microsoft Azure
- New Relic
- SentinelOne
- Splunk
- Sumo Logic
- Amazon Kinesis
- IBM QRadar
Show all 13Show fewer
- IBM Cloud Logs
What customers say
- Most praised:
- Stability, Speed, Price
- Most criticized:
- Reports, Missing features
Teams put it in front of their sites as the first layer of defense, so attacks hit it and not their own servers. Customers who face DDoS attacks every day say it keeps running without trouble, and they find it good value for that protection. The catch is that the default rules let a lot of attack traffic through, so plan on writing your own custom rules to stop the rest.
Before you buy
Where it is strong
- Runs on a global network in front of your app
- Rules managed in a dashboard or with Terraform
- Long list of log destinations for your SIEM
Ask in the demo
- Ask which features need a paid add-on, such as bot management
- Review the default rules and add custom rules for your apps
- Ask how support works on your plan
Best for: Large companies wanting edge protection plus API discovery
At a glance
- Vendor
- Akamai
- Headquarters
- Cambridge, United States
- Founded
- 1998
- Ownership
- Public company (AKAM)
- Deployment
- Hybrid
- Company size
- SMB, Mid-Market, Enterprise
- NIST CSF
- Protect, Detect
- Pricing
- Contact sales
Funding, hiring and news for Akamai on Mandos.
Our take
Akamai App & API Protector combines a web application firewall, L7 DDoS defense, bot controls and API discovery. Its Adaptive Security Engine learns attack patterns and tunes itself with machine learning, and updates arrive automatically for zero-days and CVEs. It runs on Akamai's edge, and a hybrid option extends the same protection to on-premises, hybrid cloud and multi-CDN setups.
It works with Terraform and Postman.
It belongs on this list because the firewall, bot controls, DDoS defense and API discovery come as one edge service, and the hybrid option covers apps that still sit on premises or behind more than one CDN. That makes it a fit for mid-market and enterprise teams with mixed hosting. Ask how much of the self-tuning you can inspect and override, since automatic rule changes still need an owner.
Akamai App & API Protector main features
- Web application firewall (WAF)
- L7 DDoS defense
- API discovery
- Sensitive data protection
- Bot controls
- Adaptive Security Engine
- Behavioral DDoS Engine
- Machine learning self-tuning
Akamai App & API Protector main integrations
- Terraform
- Postman
Before you buy
Where it is strong
- Self-tuning Adaptive Security Engine
- API discovery and sensitive data protection
- Hybrid option for on-premises and multi-CDN
Ask in the demo
- Ask which SIEM and ticketing systems receive its alerts
- Ask how much tuning the self-tuning engine still needs
- Ask for customer references in your industry
WAF protecting web apps and APIs from OWASP Top 10 and other threats
San Mateo, United StatesFounded 2002$86M raised
- SOC 2
- ISO 27001
- FedRAMP
- PCI DSS
- HIPAA
Best for: Regulated teams wanting managed rules, such as banks
At a glance
- Vendor
- Imperva
- Headquarters
- San Mateo, United States
- Founded
- 2002
- Deployment
- Hybrid
- Company size
- SMB, Mid-Market, Enterprise
- NIST CSF
- Protect, Detect
- Pricing
- Contact sales
Funding, hiring and news for Imperva on Mandos.
Our take
Imperva Web Application Firewall protects web apps and APIs in the cloud, on-premises or in hybrid setups. Its threat research team writes the managed rules, with daily updates and real-time updates for critical threats. Attack Analytics groups related alerts into incidents, and the product logs activity for GDPR, PII and PCI DSS audits. Imperva is now part of Thales Group.
It has a Terraform provider and sends events to Splunk, Microsoft Sentinel and Graylog.
Its place here comes from choice: a cloud service, a gateway for older on-premises apps and an elastic option for modern ones, all in one product. The audit logging maps to PCI DSS and GDPR work, which helps if you answer to regulators. Decide which option each app needs, because running gateways in your own data center is a different job from using a cloud service.
Imperva Web Application Firewall (WAF) main features
- Managed security rules with daily and real-time updates
- Protection against OWASP Top 10 vulnerabilities
- Machine learning-based attack pattern identification
- Attack Analytics with automated alert correlation
- Multiple deployment options (Cloud, Gateway, Elastic)
- Automated policy creation
- Terraform provider for infrastructure as code deployment
- Enterprise SSL certificate management with automated renewal
Imperva Web Application Firewall (WAF) main integrations
- Terraform
- Graylog
- Splunk
- Microsoft Sentinel
What customers say
- Most praised:
- Ease of use, Setup, Reports
- Most criticized:
- Interface, Reports
Imperva sits in front of websites and APIs to stop bots, DDoS floods and common web attacks, and banks show up often among the customers who review it. Day-to-day management is called simple, with a clear view of web traffic and security events. The catch is cost and learning curve, because the on-premises gateways cost more than buyers expected and the dashboards and reports take a while to learn, though customers who pushed back on price got large discounts.
Before you buy
Where it is strong
- Managed rules with daily updates
- Attack Analytics groups alerts into incidents
- Audit logging for GDPR and PCI DSS
Ask in the demo
- Ask which deployment fits you: Cloud WAF, WAF Gateway or Elastic WAF
- Ask how detailed the event logs and reports are
- Compare total price with every add-on you need
Alternatives to each solution on this list
The closest Cloud Web Application and API Protection alternatives for every pick, matched on features and integrations.
Best for: Teams running apps across many clouds
At a glance
- Vendor
- F5
- Headquarters
- Seattle, United States
- Founded
- 1996
- Ownership
- Public company (FFIV)
- Deployment
- Hybrid
- Company size
- SMB, Mid-Market, Enterprise
- NIST CSF
- Protect, Detect
- Pricing
- Contact sales
Funding, hiring and news for F5 on Mandos.
Our take
F5 WAF for Distributed Cloud is a web application firewall delivered as a service for apps in public clouds, data centers and edge locations. It combines attack signatures from F5 Labs with behavior scoring of each client, and it tunes its signatures automatically to cut false positives. It covers Layer 7 DDoS, bots, IP reputation and allow and deny lists, and a managed option adds a 24x7 security team.
It runs with AWS, Azure, Google Cloud, VMware, IBM Cloud and Red Hat OpenShift.
It earns a spot because one policy follows your apps wherever they run: F5's points of presence, your cloud accounts or your data center, on VMs, containers or serverless. That suits teams with apps spread across several clouds. If you take the managed option, ask which changes the 24x7 team makes on its own and which still need your sign-off.
F5 WAF for Distributed Cloud main features
- Signature-based attack detection with CVE coverage
- Behavior-based threat detection and client scoring
- Automatic attack signature tuning
- Layer 7 DDoS protection
- Bot and automated threat detection
- IP reputation and allow/deny lists
- OWASP Top 10 protection
- Multi-application security dashboard
F5 WAF for Distributed Cloud main integrations
- AWS
- Azure
- Google Cloud
- VMware
- IBM Cloud
- Red Hat OpenShift
Before you buy
Where it is strong
- Signatures plus behavior scoring of each client
- Automatic signature tuning to cut false positives
- Managed option with a 24x7 security team
Ask in the demo
- Ask how it differs from F5 BIG-IP Advanced WAF you may already run
- Ask which SIEM systems receive its logs
- Ask for customer references for the Distributed Cloud service
Best for: Teams already running Fortinet security
At a glance
- Vendor
- Fortinet
- Headquarters
- Sunnyvale, United States
- Founded
- 2000
- Ownership
- Public company (FTNT)
- Deployment
- Hybrid
- Company size
- SMB, Mid-Market, Enterprise
- NIST CSF
- Protect, Detect
- Pricing
- Contact sales
Funding, hiring and news for Fortinet on Mandos.
Our take
Fortinet FortiWeb protects web apps and APIs against the OWASP Top 10, bots and DDoS attacks. It uses machine learning to model each application and spot unusual requests and zero-day attacks. It finds APIs from live traffic, tells good bots from bad ones without heavy CAPTCHAs, and offers a security team as a service. It runs as an appliance, a virtual machine or a cloud service.
It works with FortiGate, FortiSandbox and FortiGuard.
It belongs here because one product ships in three forms, so you can cover older and newer apps the same way, and its checks on scripts in payment pages help with PCI DSS. If you already run FortiGate, it shares that ecosystem. If you do not, weigh whether you want one more vendor console in the mix.
Fortinet FortiWeb main features
- OWASP Top 10 protection
- Anomaly detection
- API discovery and protection
- Bot mitigation
- Client-side protection
- Zero-day attack detection
- Machine learning application modeling
- DDoS protection
Fortinet FortiWeb main integrations
- FortiGate
- FortiSandbox
- FortiGuard
What customers say
- Most praised:
- Reports, Speed
- Most criticized:
- Setup, Price
FortiWeb guards public web apps and APIs against common attacks and new zero-day threats, and customers who already run other Fortinet products say it slots right into that setup. Day to day, the web console is easy to manage and the box handles heavy traffic without strain. Getting there is harder, because the first setup and rule tuning take real know-how, especially for teams without web development experience.
Before you buy
Where it is strong
- Machine learning model of each application
- Bot defense that limits CAPTCHAs
- Runs as appliance, virtual machine or cloud service
Ask in the demo
- Plan time and help for the first setup
- Ask which features the cloud version includes
- Compare the price with the other cloud services here
Blocks web attacks, API attacks, bots, account takeover and L7 DDoS from one engine
San Francisco, United StatesFounded 2016$75M raised
- SOC 2
Best for: API-heavy teams that want web, API and bot protection in one engine
At a glance
- Vendor
- Wallarm
- Headquarters
- San Francisco, United States
- Founded
- 2016
- Deployment
- Hybrid
- Company size
- SMB, Mid-Market, Enterprise
- NIST CSF
- Protect, Detect, Respond
- Pricing
- Contact sales
Funding, hiring and news for Wallarm on Mandos.
Our take
Wallarm Cloud-Native WAAP blocks OWASP Top 10 attacks, API attacks, credential stuffing, brute force, bad bots and Layer 7 DDoS. It adds virtual patching for zero-days without code changes, distributed rate limiting and geographic blocking. It runs inline in your own cloud, Kubernetes or on-premises setup, or on Wallarm's Security Edge through a DNS change, and it does not need a CDN. It sends alerts to Splunk, QRadar, Sumo Logic, Datadog, PagerDuty, Jira and Slack.
It earns a place because one engine covers web attacks, API attacks and bot abuse, so you do not run a WAF, an API gateway and a bot product side by side. If you run the filtering nodes yourself, ask how much upkeep they need, and test blocking on your own API traffic before you switch it on.
Wallarm Cloud-Native WAAP main features
- OWASP Top 10 protection
- OWASP API Top 10 protection for REST, GraphQL, gRPC, SOAP and WebSocket
- Bot, credential stuffing and account takeover protection
- Layer 7 DDoS protection with distributed rate limiting
- Virtual patching for zero-day flaws
- Geographic blocking
- Behavior-based detection with no signatures to tune
- Inline deployment on NGINX, Envoy, Kong and Kubernetes
Wallarm Cloud-Native WAAP main integrations
- PagerDuty
- OpsGenie
- Jira
- Splunk
- Sumo Logic
- QRadar
- Demisto
- GitHub
- GitLab
- Jenkins
- CircleCI
- Slack
Show all 18Show fewer
- Microsoft Teams
- Twilio
- Gmail
- Prometheus
- Grafana
- Datadog
Before you buy
Where it is strong
- Web, API and bot protection in one engine
- Runs in your own setup or on Security Edge
- Virtual patching for zero-days
Ask in the demo
- Ask how much upkeep self-hosted nodes need
- Test blocking on your own API traffic in a trial
- Ask how Security Edge handles large traffic floods
How they fit your cybersecurity program (NIST CSF)
NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. The grid shows which functions each pick maps to in our record, so you can see where a solution sits in your program and what it leaves to other controls.
Where each solution sits on NIST CSF 2.0
All 6 solutions map to Protect and Detect. 1 of 6 maps to Respond. None map to Govern, Identify or Recover.
Swipe the table sideways to see all six functions.
| Solution | ||||||
|---|---|---|---|---|---|---|
| All solutions on this list | 0 of 6 | 0 of 6 | 6 of 6 | 6 of 6 | 1 of 6 | 0 of 6 |
| Cloudflare WAF | – | – | 2 of 5 | 1 of 2 | – | – |
| Akamai App & API Protector | – | – | 2 of 5 | 1 of 2 | – | – |
| Imperva Web Application Firewall (WAF) | – | – | 1 of 5 | 2 of 2 | – | – |
| F5 WAF for Distributed Cloud | – | – | 2 of 5 | 1 of 2 | – | – |
| Fortinet FortiWeb | – | – | 2 of 5 | 2 of 2 | – | – |
| Wallarm Cloud-Native WAAP | – | – | 1 of 5 | 2 of 2 | 1 of 4 | – |
A cell shows how many of that function's categories the solution maps to.
A product helps you reach these outcomes, but it does not make you compliant on its own. Your people and processes do the rest.
CISO checklist for selecting a Cloud Web Application and API Protection product
I built this checklist from my own work researching, rolling out and reviewing products like these. I recommend you go through it before you sign.
Nika (Nikoloz) Kokhreidze, Founder of CybersecTools and Mandos
Work through these steps in order to go from open websites and APIs to a contract you can defend.
Your ticks stay in this browser. Nothing is sent to us.
Compare Cloud Web Application and API Protection solutions side by side
Features, integrations, NIST coverage and deployment for every Cloud Web Application and API Protection solution we list, in one table.
Compare Cloud Web Application and API Protection solutions →
Other solutions we considered for this shortlist
We looked at 34 products for this list. These did not make the 6 above but are worth a look for the right team.
1.Astra DDoS Protection · Astra Security
Website security suite with DDoS, WAF, malware scanning & bot protection.
2.Cisco Web Application and API Protection (WAAP) · Cisco
Web app, mobile app, and API protection with bot and DDoS mitigation
3.Oracle Cloud Infrastructure WAF · Oracle
A cloud-based web application firewall service that protects web applications from malicious traffic through threat intelligence, access controls, and bot management capabilities.
4.Alibaba Cloud Web Application Firewall (WAF) · Alibaba Cloud
Alibaba Cloud's fully managed WAAP solution for web, API, and bot protection.
5.Blackwall GateKeeper · Blackwall
Web security & traffic filtering platform for hosting providers
6.A10 Networks ThreatX · A10 Networks
Web app and API protection platform with WAF, bot, DDoS, and API security
7.Radware Cloud WAF Service · Radware
A cloud-based web application firewall service that combines traditional WAF capabilities with AI-driven behavioral analysis to protect web applications across hybrid and cloud environments.
8.Sectigo SiteLock Website Protection Solutions · Sectigo
Website security platform with malware scanning, WAF, CDN, and DDoS protection
9.Comodo Website Security · Xcitium
Website security platform with WAF, CDN, malware scanning, and backup
10.Myra Application Security · Myra Security
Cloud-based web app & API protection with WAF, DDoS mitigation & bot mgmt
Explore all Cloud Web Application and API Protection solutions
Conclusion
Start with where your apps run and how much help you want. Cloudflare suits teams that want strong protection with little upkeep. Akamai fits large companies that need edge protection, bot controls and API discovery at scale. Imperva suits regulated teams that want managed rules and audit logging.
F5 fits apps spread across several clouds and data centers. FortiWeb suits teams already on Fortinet. Wallarm suits API-heavy teams that want web, API and bot protection from one engine.
Frequently Asked Questions
What is the difference between a WAF and WAAP?
A WAF blocks attacks on web apps, such as SQL injection. WAAP adds bot management, API protection and DDoS defense in one service. All products here cover more than a classic WAF.
Do I need a separate API security product?
Many WAAP services now find your APIs and block attacks on them. A separate API security product goes deeper into API logic and data exposure. Start with what your WAAP covers, then fill gaps.
Will a WAAP slow down my website?
It can add a little delay because traffic passes through the vendor's network. Most services also cache content, which can speed things up. Test page load times during a trial.
Why do WAF rules need tuning?
Default rules can block real users or miss attacks aimed at your app. Teams usually run new rules in monitor mode first, then switch to blocking. Reviewers of several products here say tuning takes time.
Should I choose a cloud service or an appliance?
A cloud service blocks attacks before they reach your network and absorbs large floods of traffic. An appliance keeps traffic inside your data center. Some products here offer both.
Why do some products have no customer section?
We only summarize customer views when we find enough first-hand reviews from more than one place. If a product has too few public reviews, ask that vendor for references.
Sources
These are the pages we reviewed for each pick: the vendor's own product page and website, its market data on Mandos, and every review page we read for customer feedback.
1.Cloudflare WAF · Cloudflare, Inc.
Product page · Cloudflare, Inc. website · Market data on Mandos · PeerSpot · Gartner Peer Insights · Reddit: cloudflare custom waf rules · Reddit: waf prices · Reddit: cloudflare waf configuration for public sites · Reddit: waf for free accounts · Reddit: is waf necessary when you have cloudflare cdn to
2.Akamai App & API Protector · Akamai
Product page · Akamai website · Market data on Mandos · G2 · Gartner Peer Insights · Reddit
3.Imperva Web Application Firewall (WAF) · Imperva
Product page · Imperva website · Market data on Mandos · Gartner Peer Insights · PeerSpot · Reddit: what waf solution do you use · G2 · Reddit: worst experience using a cybersecurity product
4.F5 WAF for Distributed Cloud · F5
Product page · F5 website · Market data on Mandos · G2 · Gartner Peer Insights · Reddit: protecting saas applications through f5 waf · Reddit: palo alto waas
5.Fortinet FortiWeb · Fortinet
Product page · Fortinet website · Market data on Mandos · Gartner Peer Insights · G2 · PeerSpot · Reddit: waf prices · Reddit: fortigate waf capabilities · Reddit: compare fortiweb with f5 and cloudflare waf · Reddit: fortinet web application firewall whats your · Reddit: fortigate waf vs fortiweb
6.Wallarm Cloud-Native WAAP · Wallarm
Product page · Wallarm website · Market data on Mandos · Gartner Peer Insights
