Now Tech Web Application
Now Tech Web Application
This PDF is only licensed for individual use when downloaded from forrester.com or reprints.forrester.com. All other distribution prohibited.
forrester.com
For Security & Risk Professionals
2 Select Vendors Based On Functionality The Forrester Tech Tide™: Zero Trust Threat
Prevention, Q3 2018
WAF Market Presence Segments
Lay Your Security Tech Foundation
WAF Functionality Segments
13 Supplemental Material
Tools that examine input to and responses from web applications and APIs to detect and block
exploits or attack attempts, and to enforce security policies based on attack signatures, protocol
standards, and anomalous detection.
›› Apply consistent and global security policies. Many firms start with a goal of consistent WAF
policies to protect all applications equally — no matter where they deploy them. However, once
that goal is met, firms then demand a more risk-based approach and increase WAF protections
based on application type, business line, or data that the application touches.
›› Comply with regulations. PCI DSS requirements continue to drive the majority of WAF adoption.
However, it’s important to remember that compliance is the minimum bar and not the optimal use
case. To optimize their protections, firms must go beyond mere compliance and apply WAFs to all
applications — not just the ones that require it.
We segmented the vendors in this market into three categories, based on WAF revenue: large
established players (more than $100 million in WAF revenue), midsize players ($10 million to $100
million in revenue), and smaller players (less than $10 million in revenue) (see Figure 1). We did not
include vendors that we estimated to have less than $1 million in revenue.
© 2019 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. 2
[email protected] or +1 866-367-7378
For Security & Risk Professionals December 20, 2019
Now Tech: Web Application Firewalls, Q4 2019
Forrester’s Overview Of 31 WAF Providers
FIGURE 1 Now Tech Market Presence Segments: Web Application Firewalls, Q4 2019
Akamai Technologies
Imperva
Web Application
Firewalls
Q4 2019
*Forrester estimate
© 2019 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. 3
[email protected] or +1 866-367-7378
For Security & Risk Professionals December 20, 2019
Now Tech: Web Application Firewalls, Q4 2019
Forrester’s Overview Of 31 WAF Providers
To explore functionality at a deeper level, we broke the WAF market into four segments, each with
varying capabilities (see Figure 2 and see Figure 3):
›› CDN-adjacent WAFs guard on the network edge. CDNs optimize delivery of web pages and
other web content based on the geographic location of users. Many CDNs also offer security
controls such as WAFs, which customers can deploy before a web server or — even better — at
the edge of the CDN, closer to the origin of malicious traffic, giving even better performance to web
content. However, to protect web assets, CDNs must route web traffic to these assets through their
network. Forrester only included vendors that create their own WAFs rather than ones that partner
with third parties to offer WAF functionality.
›› WAF specialists offer layer 7 protection as part of a security portfolio. Deployments of WAFs
from specialists include appliances, virtual appliances, or rerouting web traffic through specific
network PoPs like CDN-adjacent WAFs. WAF specialist vendors focus on web asset protection and
include WAFs as part of their portfolio of products.
© 2019 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. 4
[email protected] or +1 866-367-7378
For Security & Risk Professionals December 20, 2019
Now Tech: Web Application Firewalls, Q4 2019
Forrester’s Overview Of 31 WAF Providers
FIGURE 2 Now Tech Functionality Segments: Web Application Firewalls, Q4 2019, Part 1
CDN-adjacent Cloud-provider-
WAF adjacent WAF
Proprietary rulesets
Supports compliance
Modification of rules
Crowdsourced rules
Suggested rules
Autoimplemented rules
© 2019 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. 5
[email protected] or +1 866-367-7378
For Security & Risk Professionals December 20, 2019
Now Tech: Web Application Firewalls, Q4 2019
Forrester’s Overview Of 31 WAF Providers
FIGURE 3 Now Tech Functionality Segments: Web Application Firewalls, Q4 2019, Part 2
Proprietary rulesets
Supports compliance
Modification of rules
Crowdsourced rules
Suggested rules
Autoimplemented rules
© 2019 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. 6
[email protected] or +1 866-367-7378
For Security & Risk Professionals December 20, 2019
Now Tech: Web Application Firewalls, Q4 2019
Forrester’s Overview Of 31 WAF Providers
Imperva WAF specialist NA 45%; LATAM 5%; Financial services; Amadeus; Digicert;
EMEA 22%; AP 28% media and NTT Technocross
entertainment;
retail
© 2019 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. 7
[email protected] or +1 866-367-7378
For Security & Risk Professionals December 20, 2019
Now Tech: Web Application Firewalls, Q4 2019
Forrester’s Overview Of 31 WAF Providers
Barracuda Network- NA 48%; LATAM 1%; Financial services; Vendor did not
Networks performance- EMEA 31%; AP 20% healthcare; retail disclose
adjacent WAF
Ergon WAF specialist NA 1%; EMEA 91%; AP Financial services; Generali; Raiffeisen;
Informatik 8% insurance SBB (Swiss
Railways)
Instart WAF specialist NA 75%; LATAM 6%; Retail; travel and Neiman Marcus
EMEA 12%; AP 7% hospitality;
financial services
*The vendor did not provide information for this cell; this is Forrester’s estimate.
© 2019 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. 8
[email protected] or +1 866-367-7378
For Security & Risk Professionals December 20, 2019
Now Tech: Web Application Firewalls, Q4 2019
Forrester’s Overview Of 31 WAF Providers
FIGURE 5 Now Tech Midsize Vendors: Web Application Firewalls, Q4 2019 (Cont.)
Microsoft Cloud-provider- NA 44%; LATAM 1%; Financial services; Vendor did not
adjacent WAF EMEA 37%; AP 18% retail; disclose
manufacturing
Penta WAF specialist NA 1%; LATAM 2%; Government; Vendor did not
Security EMEA 5%; AP 92% financial services disclose
Systems
Rohde & WAF specialist NA 4%; LATAM 2%; Financial services; ALD; City of
Schwarz EMEA 90%; AP 4% healthcare; Walldorf; French
Cybersecurity government Ministry of the
Interior
Signal WAF specialist NA 87%; EMEA 6%; AP Financial services; Chick-fil-A; Under
Sciences 7% high-tech; media Armour; WeWork
and entertainment
*The vendor did not provide information for this cell; this is Forrester’s estimate.
© 2019 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. 9
[email protected] or +1 866-367-7378
For Security & Risk Professionals December 20, 2019
Now Tech: Web Application Firewalls, Q4 2019
Forrester’s Overview Of 31 WAF Providers
Fastly CDN-adjacent NA 60%; LATAM 5%; Retail; media and Alaska Airlines; The
WAF EMEA 30%; AP 5%* entertainment; New York Times;
high-tech Pinterest
Indusface WAF specialist NA 15%; LATAM 5%; Financial services; CxC Networks;
EMEA 5%; AP 75% media and HDFC Life; Indusind
entertainment; Bank; TCS
retail
Oracle Cloud-provider- NA 65%; LATAM 5%; Retail; travel and Vendor did not
adjacent WAF EMEA 25%; AP 5%* hospitality; disclose
manufacturing
*The vendor did not provide information for this cell; this is Forrester’s estimate.
© 2019 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. 10
[email protected] or +1 866-367-7378
For Security & Risk Professionals December 20, 2019
Now Tech: Web Application Firewalls, Q4 2019
Forrester’s Overview Of 31 WAF Providers
FIGURE 6 Now Tech Small Vendors: Web Application Firewalls, Q4 2019 (Cont.)
Qualys WAF specialist NA 60%; LATAM 5%; Financial services Arabbank; Liberty
EMEA 30%; AP 5% University
Reblaze WAF specialist NA 36%; LATAM 4%; Travel and eBay; Forbes
EMEA 42%; AP 18% hospitality; retail; Media; SolarWinds
high-tech
*The vendor did not provide information for this cell; this is Forrester’s estimate.
© 2019 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. 11
[email protected] or +1 866-367-7378
For Security & Risk Professionals December 20, 2019
Now Tech: Web Application Firewalls, Q4 2019
Forrester’s Overview Of 31 WAF Providers
Recommendations
›› Use bot management to remove malicious automated traffic. Using programming know-
how, malicious attackers create automated attacks that mimic human behavior. These attacks
are usually too low and slow or masked as good human traffic to be caught by WAFs. Use bot
management tools instead to thwart these complex attacks.5
›› Apply API security technologies to reinforce APIs. Applying the full stack of API-specific
defenses offers APIs a level of protection beyond that of other web assets. API management
solutions provide authorization, authentication, and rate limiting based on identity.6 Additional tools
read API specification files and create positive security rules. Layer the technologies to achieve
optimal protection.
›› Deploy runtime application self-protection to hide security flaws from attackers. Today,
WAFs have a limited attack response such as block, delay, and misdirect. However, the best
response would be for the application to run as if security flaws didn’t exist in the first place. This
is the promise of runtime application self-protection (RASP) tools.7 Use RASP tools to protect
applications that don’t have active development teams or applications that change quickly.
Unfortunately, RASP tools consume processing power while creating their virtual patches. Use a
WAF in conjunction with a RASP tool to reduce the load the RASP will consume by rejecting known
bad traffic.
© 2019 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. 12
[email protected] or +1 866-367-7378
For Security & Risk Professionals December 20, 2019
Now Tech: Web Application Firewalls, Q4 2019
Forrester’s Overview Of 31 WAF Providers
To help you put research Translate research into Join our online sessions
into practice, connect action by working with on the latest research
with an analyst to discuss an analyst on a specific affecting your business.
your questions in a engagement in the form Each call includes analyst
30-minute phone session of custom strategy Q&A and slides and is
— or opt for a response sessions, workshops, available on-demand.
via email. or speeches.
Learn more.
Learn more. Learn more.
Supplemental Material
To complete our review, Forrester requested information from vendors. If vendors did not share this
information with us, we made estimates based on available secondary information. We’ve marked
companies with an asterisk if we estimated revenues or information related to geography or industries.
Forrester fact-checked this report with vendors before publishing.
We would like to thank the individuals from the following companies who generously gave their time
during the research for this report.
© 2019 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. 13
[email protected] or +1 866-367-7378
For Security & Risk Professionals December 20, 2019
Now Tech: Web Application Firewalls, Q4 2019
Forrester’s Overview Of 31 WAF Providers
Citrix Reblaze
F5 Networks Templarbit
Imperva ThreatX
Indusface Verizon
Instart Wallarm
Kemp
Endnotes
For more information about the history of WAFs, see the Forrester report “Web Application Firewall: 2010 And
1
Beyond.”
In the case of Capital One, the breach was attributed to WAF misconfiguration. Source: Brian Krebs, “What We Can
2
Learn from the Capital One Hack,” Krebs on Security blog, August 2, 2019 (https://krebsonsecurity.com/2019/08/
what-we-can-learn-from-the-capital-one-hack/).
Other breaches such as the ones that occurred at Equifax and British Airways could have been prevented with a
properly configured WAF. Source: “3 Massive Data Breaches that Could Have Been Easily Avoided,” Penta Security
Blog, October 25, 2018 (https://www.pentasecurity.com/blog/3-notorious-data-breaches-easily-avoided/) and Thomas
Pohle, “BA Data Breach Could Have Been Prevented By Web Application Firewalls,” Link11 DDoS blog, September 7,
2018 (https://www.link11.com/en/blog/ba-data-breach-could-have-been-prevented-by-web-application-firewalls/).
3
See the Forrester report “Forrester Analytics: Application Security Solutions Forecast, 2017 To 2023 (Global).”
For more information on spending predictions for application security, see the Forrester report “Application Security
Market Will Exceed $7 Billion By 2023.”
4
Source: Forrester Analytics Global Business Technographics® Infrastructure Survey, 2019.
For more information about bot management tools, look for Forrester’s upcoming report about bot management in Q4
5
of 2019.
© 2019 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. 14
[email protected] or +1 866-367-7378
For Security & Risk Professionals December 20, 2019
Now Tech: Web Application Firewalls, Q4 2019
Forrester’s Overview Of 31 WAF Providers
For more information about API management solutions, see the Forrester report “The Forrester Wave™: API
6
For more information about RASP tools, see the Forrester report “The Forrester New Wave™: Runtime Application
7
Self-Protection, Q1 2018.”
© 2019 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. 15
[email protected] or +1 866-367-7378
We work with business and technology leaders to develop
customer-obsessed strategies that drive growth.
Products and Services
›› Core research and tools
›› Data and analytics
›› Peer collaboration
›› Analyst engagement
›› Consulting
›› Events
Client support
For information on hard-copy or electronic reprints, please contact Client Support at
+1 866-367-7378, +1 617-613-5730, or [email protected]. We offer quantity
discounts and special pricing for academic and nonprofit institutions.
Forrester Research (Nasdaq: FORR) is one of the most influential research and advisory firms in the world. We work with
business and technology leaders to develop customer-obsessed strategies that drive growth. Through proprietary
research, data, custom consulting, exclusive executive peer groups, and events, the Forrester experience is about a
singular and powerful purpose: to challenge the thinking of our clients to help them lead change in their organizations.
For more information, visit forrester.com. 157797