Been running our web apps on AWS for a few years. When we needed a WAF, I looked at Imperva and others.
Their sales pitch was all about "advanced bot protection" and "zero-day coverage." But when I compared it to AWS WAF + Shield Advanced, the price difference was huge. We're talking 5x more per month for similar coverage on our traffic levels. The cloud provider tools got the job done. Blocked the common stuff, rate limiting works fine.
I don't see the value. You're just paying for a fancy dashboard and a brand name. The "premium" feels like a tax on fear.
I run a 50-person fintech's infra. We've got both AWS WAF+Shield and a Cloudflare WAF tier in front of various apps.
- **Real monthly cost at scale:** For ~50M requests/month, our AWS WAF bill (rules + Shield Advanced) runs $2,300-2,800. The comparable quote from a top-tier WAFaaS vendor started at $12k and wanted a commit. The delta buys a lot of engineering time.
- **Deployment and lock-in:** AWS WAF is just a set of rules you attach to an ALB/CloudFront. It's boring, which is good. Migrating out of a WAFaaS to another provider typically requires re-implementing every rule logic from scratch in their proprietary UI/DSL. That's a 2-3 week project of tedious mapping.
- **Where the "advanced" stuff actually matters:** If you're not a top-1000 site, you're not seeing sophisticated enough bots to need the fancy JavaScript challenges. The common OWASP stuff and geo-blocking works identically. The one exception is if you have a dedicated appsec team that writes custom ML-based rules; the third-party platforms give them a better sandbox.
- **Support and break-fix:** With AWS, a WAF rule misbehaving is your problem. With the premium service, you get a Slack channel to their NOC. For us, that wasn't worth $9k/month. Their mean time to acknowledge during our PoC was under 15 minutes, though.
I'd pick AWS WAF+Shield for any team under 200 people that already lives in AWS. The only reason to go third-party is if you're in a heavily targeted industry (gambling, crypto) and need the managed service to be your 24/7 appsec team. Tell us your team's appsec headcount and if you're in a regulated industry.
-- old school
Totally agree, especially for the "common stuff." The managed rule sets from AWS or Azure are solid for OWASP top 10 and known bad IPs. Where that sales pitch gets interesting, though, is in behavioral analysis for bot protection. Cloud provider tools are mostly rules-based, while a premium service might be modeling traffic patterns.
That said, for most apps, the volume of truly sophisticated bots isn't high enough to justify 5x cost. You can get pretty far with custom rate-based rules and maybe a third-party threat intel feed. It's like paying for a Formula 1 pit crew when you drive a sedan to the grocery store.
Test everything.