Thales Imperva Cloud WAF review: Keeping the bad actors out of your corporate websites

Part of the mighty Thales cybersecurity division, the Imperva WAF (web application firewall) solutions stand out from the competition as they support multiple deployment scenarios and are designed to be up and running in minutes. It looks to have every angle covered, as Imperva WAF is available as a SaaS-based service, can be hosted locally on customer equipment, virtualized on a choice of cloud and on-premises hypervisors, or delivered as a dedicated and hardened turnkey gateway appliance.

It offers an extensive range of security features, with many implemented as modules. Along with out-of-the-box website protection, options include advanced bot protection, API security, L3/4/7 DDoS protection, client-side protection, and attack analytics.

In this review, we tested the Imperva Cloud WAF solution, which is hosted on the Imperva globally distributed content delivery network (CDN) and protects any public-facing website along with its associated applications and APIs. At its foundation, Imperva Cloud WAF functions as a secure reverse proxy that intercepts and inspects all web traffic, but there's a lot more going on in the background as the CDN employs a global network of data centres to host these services.

Called points of presence (PoPs), Imperva Cloud WAF defaults to making all of them available to protect your websites but automatically uses the nearest one to a user for request handling. Typical benefits are website performance optimisation, reduced latency, intelligent caching, and integrated load balancing with Anycast routing providing automated failover between PoPs without requiring any changes to DNS resolution.

Thales Imperva Cloud WAF review: Simple deployment

To get the most realistic experience, we deployed Imperva Cloud WAF in a live environment and used it to protect three active websites. No limited simulations here, as all threats detected would be genuine and in real time.

From our account portal, we added the websites using their full domain names and chose to have Imperva manage all SSL certificates. Sensibly, Imperva requires you to prove you own the domains before it will issue site SSL/TLS certificates, and we used the automatically generated record name and CNAME record value to update our hosting provider's DNS services.

Once domain ownership had been validated, we added the A records provided to route website traffic through Imperva's servers. A validation process confirmed traffic was being correctly routed, and a quick glance at the portal's configuration posture status panel showed green lights for SSL certificates, DDoS and WAF settings, plus DNS configuration confirming that all traffic to our websites was going through Imperva's servers.

Protection is instant, as a default policy is created, applied to all websites, and set to block malicious visitors and requests. You can easily create your own custom policies and assign them to specific websites, with each one containing rules for cross-site scripting (XSS), illegal resource access, remote file inclusion, and SQL injection.

Thales Imperva Cloud WAF review: Attack alert

The cloud portal provided a wealth of information about our security posture, and we were alarmed to see that from the moment Cloud WAF had been activated, our websites were constantly under attack. Within a day, it had reported on illegal resource access, XSS, bad bot, DDoS bot, SQL injection, and remote file inclusion attacks from multiple countries.

During our extended testing period, we saw many thousands of attacks, but Cloud WAF cut cleanly through the alert smokescreen. The Attack Analytics service uses ML algorithms and AI to sort and condense daily security alerts into concise and manageable lists of incidents prioritised by threat severity.

This worked extremely well as the attack analytics dashboard presented a tidy graphical overview of events and incidents over time, which we could filter to show all protected websites or specific ones along with all blocked or alerted events. Charts showed the dominant attack origin countries, the top violations, the most popular attack tools, and the most attacked websites, with a highlight chart revealing the number of similar incidents identified by Imperva across its entire customer base and those associated with known CVEs.

Thales Imperva Cloud WAF review: Bad bots and DDoS protection

Imperva Cloud WAF includes sophisticated bot protection for smaller businesses that employs signature, IP reputation, and rate-limiting detection methods and is designed to block vulnerability scanners, simple scrapers, known bad bots, and DDoS attacks. The Advanced Bot Protection (ABP) add-on is aimed at larger businesses and dynamically sorts the good bots from the bad using behavioural analysis, ML, device fingerprinting, threat intelligence feeds, and progressive challenges.

The ABP dashboard presents a vast amount of information on bot activity and provides filters to fine-tune the information. The AI Tools page displayed graphs of all detected AI tools, agents, and web crawlers accessing our websites and showed how our website data was being scraped to train LLMs. We could see plenty of AI bot activity, such as ClaudeBot, Applebot, PetalBot, and GPTBot. Plus, the highly aggressive Bytespider and ABP policies and rulesets can be used to protect specific web pages from their unwanted attention.

Imperva Cloud WAF includes the DDoS Protection for Websites component, which blocks malicious DDoS activity, including volumetric attacks at Layer 3 and 4 and application-level attacks at Layer 7. Imperva's global network of over 60 high-capacity PoPs offers a total scrubbing capacity of 13Tbps and can process over 65 billion attack packets per second, allowing it to boast a 3-second mitigation SLA for any size, type, and duration of attack.

Protection was simple to configure for each website, and for testing, we used the HOIC (High Orbit Ion Cannon) tool to generate Layer 7 DDoS attacks – we own the websites, so there are no issues of legality. As soon as the tests started, Imperva Cloud WAF blocked all attack traffic, posted alerts in the portal summary page, issued email alerts in under a minute, and sent another when the attack had stopped.

Thales Imperva Cloud WAF review: Is it worth it?

For mid-sized businesses and enterprises – absolutely. The damage to their brand reputation and the clean-up operation after a successful website attack will probably cost many, many times more.

The simple cloud deployment process is a standout feature, as it didn't take long to get Imperva Cloud WAF protecting our websites. The cloud portal is another winner as it is capable of providing an incredible amount of information about all detected attacks and yet manages to condense it all down to manageable lists of actionable events.

Our test websites may be low-key affairs, but we were shocked by the sustained number of attacks they were being subjected to on a daily basis and from all around the globe. The level of attacks will no doubt be exponentially greater for high-profile corporate websites and will only get worse with the advent of dark LLMs and weaponised AI. From our experience, we rate Imperva Cloud WAF highly and consider it an ideal website security solution for mid-sized businesses and enterprises.