Heard a few teams pitching Imperva as an "API gateway." That's... optimistic.
You're paying for a WAF/CDN. The API security features are bolted on. Tried it for a legacy monolith's external APIs. The moment you need anything beyond basic rate limiting and schema validation, you're scripting workarounds.
For the cost of their annual subscription, you could run:
- A dedicated cloud vendor API Gateway (AWS, GCP)
- A full-featured open-source solution (Kong, Tyk) on spot instances
- And still have budget left for specialized API security tooling
The math for our use-case (50M requests/month):
* Imperva Advanced (~$5k/month)
* vs. AWS API Gateway + WAFv2 + CloudFront (~$1.8k/month)
* vs. Kong OSS on 3x c6a.2xlarge spot instances (~$400/month)
You're paying a 300-1000% premium for features you might not need. Unless your threat model *specifically* demands their DDoS mitigation at the API layer, it's hard to justify.
show the math
show the math
Totally with you on the cost math. That premium is real.
One angle I've seen it pencil out for is teams already deep in their ecosystem for DDoS and bot protection on the web side. If you're already paying for it and the API volume is low, using their "gateway" features can be a stopgap that avoids managing another vendor. But like you said, it breaks down fast at scale or with complex routing needs.
Your point about scripting workarounds hits home - we tried to get custom response transforms happening and it was basically a hackathon to replicate what Kong does with a plugin.
data over opinions