As WAFs Evolve To App Protection Platforms, Buyers Use Multi-WAF To Defend When we interviewed customers of the vendors we evaluated in The Forrester Wave™: Web Application Firewall Solutions, Q1 2025, we learned about their choice of WAF vendors, how quickly they moved from logging mode to blocking mode, and what WAF features they used on a regular basis.

Akamai App & API Protector Amazon Web Services. AWS WAF Cloudflare. Cloudflare WAF F5. F5 Distributed Cloud WAF Fastly. Fastly Next-Gen WAF Fortinet. FortiWeb Cloud Google. Google Cloud Armor Imperva. Imperva Application Security Microsoft. Azure Web Application Firewall Radware. Cloud Application Protection Service Evaluation Overview We evaluated vendors against three categories: Current offering.

You can use web application firewall (WAF) solutions to protect web applications and APIs from well-known and zero-day attacks, meet and demonstrate compliance with key standards, and apply consistent, global security policies and add specific ones. But to realize these benefits, you’ll first have to select from a diverse set of vendors that vary by size, type of offering, geography, and use case differentiation.

In recent years, web application firewall (WAF) vendors have expanded their capabilities beyond the OWASP Top 10 and now offer web application protection platforms to address the broader application attack surface. These platforms help organizations detect and block malicious application and API traffic that could lead to a breach while making sure that legitimate traffic gets through unimpeded.

After years of web application firewall (WAF) vendors building and buying adjacent application security tools, like bot management and API security, most have consolidated their offerings into unified web application protection platforms. However, customers must ask questions about the data model, UI, and pricing bundles to ensure that they are really getting a platform .

Figure 15 Web Application Protection Platforms Initially, the combination of API-first development approaches and growing customer requirements blurred the line between pure-play API security tools and web application firewalls (WAFs), then it drove their consolidation. Capabilities like bot management and client-side code protection were also incorporated along the way.

Trust, Hype, And Urgency Challenge AI Adoption In Application Security AppSec-focused vendors fall into two main categories: those providing application security testing (AST) tools to identify, remediate, and prevent flaws before they reach production and those offering web application protection platforms to secure applications and data in production environments. The biggest challenges for S&R leaders are that: Buyers are getting fatigued despite rapid AI evolution.

The top areas of increased investment include application risk management and/or application security posture management tools (31%), application security observability tools (30%), API security (29%), web application firewall (27%), and interactive application security testing (27%).

The platform also offers real-time observability and enterprise security foundations (single sign-on, role-based access control (RBAC), web application firewall (WAF), and distributed denial of service). Netlify differentiates through its frictionless onboarding and a growing suite of agent-ready primitives. However, its compute primitives are optimized for stateless request transformation in web use cases, which may constrain flexibility for advanced or long-running workloads.

Alibaba Cloud, Tencent Cloud, and Volcano Engine all provide web application firewalls (WAFs) for LLMs to improve model security. Alibaba Cloud built AI Guardrails to strengthen model and agent security. Volcano Engine built Jeddak AICC, Security Operations Agent, and Large Model Security Assessment Platform and Agent Security Management Platform to further augment AI security. NeoPaaS vendors augment AI security in low-code app and process automation.