Check Point WAF as a Service (Advanced/PAYG, Free 7 Days or 1M Requests)

I want to protect my application hosted in my cloud by preventing attacks against my top OWASP Top 10 threats. I am enabling Check Point WAF (formerly CloudGuard WAF)  as my application firewall.

The integration is straightforward because I am hosting in the cloud, so Check Point WAF (formerly CloudGuard WAF)  can be hosted in a public location wherever my cloud vendor is located as a service provider, and I can host the application within a change of DNS.

I have been using it for six months, and the biggest advantages for me are that Check Point WAF  (formerly CloudGuard WAF ) offers more than other F5 firewalls, which have only application protection called ASM (Application Security Monitoring). In contrast, Check Point WAF (formerly CloudGuard WAF) provides protection on IPS along with application protection.

Check Point WAF (formerly CloudGuard WAF) itself provides an IPS function where I can protect against my Layer 7 traffic, which is not available in other vendors. The traditional WAF does not have the capacity of IPS functions.

The intrusion prevention capability, I can only see in Layer 3 functions and stateful functions, which is the traditional firewall capability. Other vendors are keeping this in their Web Application Firewall, but Check Point WAF (formerly CloudGuard WAF) has integrated it differently.

False positives are significantly less here compared to traditional Web Application Firewalls because they are more focused on the AI front. Check Point WAF (formerly CloudGuard WAF) integrates an AI platform within the Web Application itself using API protection with AI and what they call GenAI protection.

They excel at creating the profile itself, which is the basic functionality of WAF. Normally, I deploy in preventive mode, which takes some time for learning, but I prefer to operate in preventing mode only.

The negative aspect is that Check Point WAF (formerly CloudGuard WAF) uses Check Point  Harmony in its management console, which sometimes creates latency when connecting to or opening the platform. This is one function they are lagging in.

The reporting functions need improvement. For example, I want to calculate traffic metrics, but I cannot see them in the current Check Point WAF (formerly CloudGuard WAF). To know the overall traffic for today on the application, I have to check multiple dashboards instead of one single dashboard.

I have been using it for six months, and Check Point WAF (formerly CloudGuard WAF) offers more than other F5 firewalls, which have only application protection called ASM (Application Security Monitoring). Check Point WAF (formerly CloudGuard WAF) provides protection on IPS along with application protection. Check Point WAF (formerly CloudGuard WAF) itself provides an IPS function where I can protect against my Layer 7 traffic, which is not available in other vendors.

It is very stable.

Scalability is very good.

The support team is providing good support.

It is easy to deploy and does not require much effort.

Return on Investment is a key factor for me in deciding to buy a solution on a major scale, so it is very important for me to consider it. I would say the ROI is about 15 to 20 percent.

I am comparing it to F5.

I would definitely recommend this solution because I do not want to implement one more traffic function. I can eliminate the firewall and use Check Point WAF (formerly CloudGuard WAF) alone, thus eliminating Layer 3 traffic directly connecting to my Web Application Firewall.

I would say the TCO is reduced by 20 to 22 percent. The reduction in false positives will definitely be more than 30 percent.

Breach Reduction reduces the false positive part significantly. For example, I have multiple solutions from multiple vendors, and it definitely reduces my false positive alerts and aids in my Breach Reduction efforts. If a person is having a bot attack or if someone attacks with network anomalies on my application, I can identify that.

I rate Check Point WAF (formerly CloudGuard WAF) overall as an 8 or 8.5 out of 10.

Hybrid Cloud

Amazon Web Services  (AWS )

What do you like best about the product?

Check Point WAF was mostly used for monitoring and securing internet-facing applications and APIs receiving traffic from outside clients. The majority of daily operations entailed examining rejected requests, analyzing security events post-deployment, and tuning protection rules in case legitimate traffic was impacted.

The main asset in terms of operational activities was insight provided at the HTTP and API level. This allowed for examination of request patterns, header details, path and URL parameters and, if needed, the actual contents of blocked requests, rather than looking at basic network data. It made things more clear whether strange behavior was caused by legitimate application operation, automated scanning, or attack attempts against available services.

Post-updates policy tuning was done occasionally because even minor front-end or API changes were affecting some protection settings.

What do you dislike about the product?

The tuning phase can be a lengthy one due to traffic fluctuations or custom APIs. Initially, I had to spend quite some time ensuring that blocked calls were indeed malicious or a result of the application's normal activity misinterpreted as something else.

Additionally, there is a need for constant tuning when dealing with multiple applications as well as keeping a balance between tight protection and not interrupting the production traffic.

Only after acquiring a good understanding of how signature definitions, exceptions, and policies worked internally did troubleshooting become easier.

What problems is the product solving and how is that benefiting you?

The reliance on traditional firewall filtering and manual monitoring for web application security was much higher before the deployment of Check Point WAF, as these methods were insufficient when detecting potential attacks on application layer.

With the implementation of the new system, security monitoring became more application-focused, allowing us to detect malicious activity targeted at our web applications and web APIs, as well as minimizing vulnerability to standard web attacks and gaining more control over incoming traffic.

What do you like best about the product?

What I like best about Check Point CloudGuard WAF is its strong AI-driven threat protection and ability to handle modern web and API security challenges. It does a great job at blocking common attacks like XSS and SQL injection, as well as more advanced threats like zero-day vulnerabilities without relying heavily on manual rule updates. The real-time detection and low false positives make it reliable in production environments, and it reduces a lot of manual effort for security teams.

Another thing I appreciate is how well it fits into cloud environments. Deployment is relatively smooth, and once configured properly, it provides good visibility into traffic, threats, and application behavior. The automated learning and tuning capabilities also help in reducing the overhead typically required in traditional WAF solutions.

What do you dislike about the product?

What I dislike about Check Point CloudGuard WAF is that the initial setup and fine-tuning can take time, especially for teams that are new to the platform. Some advanced configurations require deeper understanding, and integration with other tools is not always as seamless as expected. Cost can also be a factor, particularly for smaller teams or organizations.

What problems is the product solving and how is that benefiting you?

Check Point CloudGuard WAF solves the problem of securing web applications and APIs against evolving cyber threats without heavy manual intervention. It automates threat detection and prevention, reduces operational workload, and ensures continuous protection against both known and unknown attacks. For me, it helps in improving overall application security posture while saving time on manual monitoring and rule management.

Overall, my experience has been positive, especially in terms of strong protection, automation, and reduced manual effort in managing application security.

What do you like best about the product?

I use Check Point CloudGuard WAF to protect cloud-native apps and APIs from OWASP Top 10 threats, like injection and XSS, while also providing bot mitigation and granular traffic inspection. I like its seamless integration with the CI/CD pipeline, allowing security policies to be deployed as code without slowing down development. This automation ensures security enforcement with every development, eliminating manual policy updates and reducing human error, which lets developers ship faster while protecting new code immediately. I appreciate its integration with CI/CD tools like Jenkins and CircleCI, and security platforms like Wiz and AWS Network Firewall. We switched to Check Point CloudGuard WAF from a legacy web app firewall because it lacked API security and multi-cloud support, and CloudGuard WAF provides better automation and centralized policy management.

What do you dislike about the product?

The policy tuning can be complex, leading to occasional false positives. Also, dashboard sync delays sometimes occur across multi-cloud environments. The learning curve and tuning effort for non-trivial apps keep it from being a perfect fit for every team.

What problems is the product solving and how is that benefiting you?

I use Check Point CloudGuard WAF to secure cloud apps and APIs against automated attacks, zero-day exploits, and reduce manual rule tuning. It integrates seamlessly with CI/CD pipelines, automating security enforcement and allowing faster code deployment.