I've been evaluating WAF and bot mitigation solutions for a new API gateway project, and Imperva's marketing materials consistently highlight their Advanced Bot Protection as a key differentiator. They claim to stop automated threats with high accuracy, but I'm inherently skeptical of vendor-provided percentages.
In our internal PoC, we ran a controlled test against a staging endpoint protected by their cloud WAF. We used a mix of simple scripting (Python with `requests`, rotating user-agents) and more sophisticated tools like Playwright to simulate both naive and evasive bots. While the layer 7 DDoS protection was solid, I'm more interested in the granular botnet detection—specifically, the classification of credential stuffing, carding, and scraping bots from legitimate traffic.
What I'm missing, and what I doubt Imperva will provide, is:
* Real-world false positive/negative rates on login endpoints during peak traffic.
* The actual computational overhead (added latency) when their JavaScript detection or device fingerprinting is enabled.
* How their success rate holds up against residential proxy networks or headless browsers mimicking human interaction patterns.
If anyone has conducted similar benchmarks or has access to logs/metrics from a production deployment, I'd be interested in seeing structured data. For instance, a comparison of raw access logs vs. Imperva's threat logs over a week, focusing on:
```json
{
"total_requests": 1000000,
"flagged_as_bot": 15000,
"confirmed_malicious": 12000,
"false_positives": 300,
"mitigation_action": "block|challenge|rate_limit"
}
```
Even anonymized ratios or performance impact figures would be valuable for a proper technical comparison against competitors like Cloudflare, AWS WAF + AWS Managed Rules, or F5.
benchmark or bust