Cloudflare Alternatives for Cloud WAF in 2023
Cloudflare is a leading global web infrastructure and cybersecurity company. Founded in 2009, Cloudflare provides a wide range of products and services designed to improve websites’ and internet applications’ performance, reliability, and security.
One of Cloudflare’s primary focuses is on security. The company offers various security solutions to protect websites and internet applications from cyber threats, such as Distributed Denial of Service (DDoS) attacks, hacking attempts, and malicious bots. Cloudflare employs advanced technologies, including machine learning algorithms and threat intelligence, to detect and mitigate these threats in real time.
Top Cloudflare WAF Features and Benefits
Cloudflare has mitigated some of the world’s largest DDoS attacks ever recorded. This is possible because of their heavy investments in infrastructure that can handle huge DDoS attacks on applications hosted across the world.
Cloudflare, like AppTrana, also offers a DDoS mitigation system that adapts to changing user behaviour. This is especially useful when the traffic scales up and down according to how the business is doing currently.
10% of the internet traffic worldwide passes through Cloudflare as of March 2023. This is a significant adoption of Cloudflare’s WAAP and CDN products.
This means that Cloudflare processes 2 trillion requests every day. Cloudflare’s quality of threat intelligence is among the best in the business.
Powerful Bundle for SaaS Start-Ups
Cloudflare’s SSL certificate management, vanity domain support, and powerful DDoS, WAF, and API security products are great for SaaS start-ups.
While the enterprise plan comes with a big premium, the flexible pricing in the Free, Pro, and Business plans is especially beneficial for start-ups and scale-ups as the upgrades scale with their business.
Reasons Why You Might Want to Switch from Cloudflare WAF
While Cloudflare has its sweet spots, here are some of the reasons why one might consider looking for an alternative:
False Positive Monitoring
Security software is unlike most other software categories in that it must keep evolving to keep pace with the changes in the threat landscape.
While Cloudflare has world-class threat intelligence, it also has the burden of writing generic rules for its network’s hundreds and thousands of applications. That results in false positives.
Managing false positives is challenging if security is a part-time responsibility or you don’t have a large team of security experts. In many cases, application owners are forced to put the WAF in log-only mode or open up WAF making a WAF useless.
While Cloudflare has one of the best DDoS mitigation stacks, if you need support during an attack, there’s no support for free and pro plans; only chat support is available for the business plan. Good support capabilities only start in the enterprise plan. Under sophisticated DDoS attacks, it is important to have security experts to guide you.
Virtual Patching as A Service
Dev teams, especially in the technology sector, follow an agile methodology, increasing the chances for new vulnerabilities to creep into the code. One way to plug those vulnerabilities is by applying virtual patches on the WAF. To do this, you’ll need a process where you scan the vulnerabilities in a DAST scanner, remove the false positives and send the open vulnerabilities to Cloudflare for virtual patching. But this is only possible when you have the enterprise plan.
The alternative is to manage your rules with an in-house team, and what we generally see is that people don’t have the necessary skill set to write rules and test them extensively for false positives.
Request Inspection Size
In the free, pro, and business plans, you can inspect a maximum request size of 128KB. That is not enough, as it is very easy to send a payload that is greater in size.
Response Time Out
In case you have applications with longer response times, with Cloudflare, the response will time out in 100 seconds. For longer timeouts, you need the enterprise plan.
Fifteen Cloudflare Alternatives to Consider
- AWS WAF
- Azure WAF
- Palo Alto
- Google Cloud Armor
- ModSecurity(Open Source)
A Quick Snapshot Comparison for the Top 5 Alternatives
|WAF Feature||Cloudflare||AppTrana||Akamai||Imperva||Fastly||AWS WAF|
|Gartner Peer Insights Rating||4.5||4.9||4.7||4.7||4.9||4.4|
|Gartner Peer Insights Customer Recommendation Rating||93%||100%||88%||92%||97%||90%|
|DDoS Monitoring||Enterprise Only||Starts at $399||Add-On||Add-On||Ultimate Plan only||$3000 per month|
|Virtual Patching||Self managed||Starts at $99||Add-On||Add-On||Ultimate Plan only||–|
|Payload Inspection Size||128KB||134MB||Starts: 8KB
|Bot Protection||Yes||Yes||Add-On||Not available in essentials
Add-on in Professional
Bundled in Enterprise Plan
|Yes, but unsure whether it is bundled in all plans||Basic|
|Response Timeout||Default: 100 seconds
Enterprise: 6000 seconds
|Default: 300 seconds
Max: 300 seconds
|Default: 120 seconds
Max: 599 seconds
|Default: 360 seconds
|Default: 60 seconds
Max: 300 Seconds
|Default: 30 seconds
Max: 300 seconds
|Managed Services||Enterprise only||Starts at $399||Add-On||Add-On||Ultimate Plan only||Only through SI partnerships|
|DAST Scanner||Not Available||Bundled in all plans||Not Available||Not Available||Not Available||Not Available|
|Asset Monitoring||Not Available||Bundled in all plans||Not Available||Not Available||Not Available||Not Available|
|Penetration Testing||Not Available||Bundled in the $399 plan||Not Available||Not Available||Not Available||Not Available|
|API discovery||Available||Available||Available||Available as an Add-On||Available||Not Available|
|API Security||Available||Available||Available||Available||Available||Basic capabilities through API Gateway|
|API Scanning||Not Available||Bundled in the $399 plan||Not Available||Not Available||Not Available||Not Available|
|API Pen Testing||Not Available||Bundled in the $399 plan||Not Available||Not Available||Not Available||Not Available|
|Workflow-based bot mitigation||Enterprise only||Starts at $399||Add-On||Add-On||Ultimate Plan only||Only through SI partnerships|
|Origin Protection||Add-on||Bundled in all plans||Add-On||Not Available||Add-on||Available|
The Top Five Alternatives to Cloudflare: In-Depth Comparison
Out of all the WAAP providers, AppTrana is the most cost-effective, with feature parity to Cloudflare’s offerings.
Here are some of the pros of using AppTrana:
Bundled Managed Services
Whether it is DDoS monitoring, virtual patches, or false positive testing, the security research team of AppTrana always has your back.
In fact, it is the only WAAP vendor who talks about:
- 100% applications onloaded in block mode
- ZERO false positive guarantee
- 24-Hour SLA for virtually patching critical vulnerabilities.
Embedded DAST Scanner and Pen Testing
This is unique to AppTrana as it is built on the principle of “Risk-Based” application security. The embedded DAST scanner could be configured to scan web and API applications daily or at any frequency.
Then the dashboard provides a view of how many open vulnerabilities are already protected by core rules and how many will require custom rules (virtual patches).
It is a simple 1-click to request a custom rule for any open vulnerability. The rule will be created within 24 hours for all critical vulnerabilities, and the managed services team will act as an extended SOC team to test for false positives.
The premium plan also has an option for manual penetration testing, including one revalidation.
Request Inspection Size and Response Timeout
AppTrana, by default, allows you to inspect requests up to 134MB, and the response doesn’t time out until five minutes.
Now coming to the cons:
Legacy API Support
For API security, AppTrana WAAP doesn’t support legacy API formats such as SOAP.
AppTrana mostly relies on third-party feeds for threat intelligence and doesn’t nearly have as many people in the threat intelligence team as Cloudflare has.
Akamai was one of the first products that protected websites from attacks. It is the oldest product of its kind that is still being used, while Google bought a similar product called Sanctum.
Akamai App & API Protector is a modern tool that combines different types of protection, such as guarding against attacks, preventing overload on a website, stopping harmful bots, and securing APIs, all in one solution.
Akamai is also the largest CDN provider in the world. Because of its expertise in CDN, Akamai is particularly popular in areas like media, gaming, and streaming.
Here are some of the pros of using Akamai:
Akamai has 400+ security researchers who update security constantly. They use machine learning and real-time threat intelligence to keep the Adaptive Security Engine up to date. Akamai claims that this process reduces false positives by 5X.
While the scale of Cloudflare regarding the number of websites behind the WAAP is unparalleled, Akamai is also very good as it has several large Fortune 500 customers, and the big security research team provides solid threat intelligence.
Prolexic is Akamai’s DDoS protection service, supported by a 20 Tbps network for defending against DDoS attacks. It includes a SOCC (Security Operations Command Center) that offers round-the-clock support for a fully managed DDoS protection solution.
Additionally, Prolexic provides a Network Cloud Firewall, which allows IT teams to automate or manually control access control lists.
Page Integrity Manager
Now coming to the cons:
Even in the premium end of the market, Akamai is more expensive than most of the other WAAP providers. If you can afford Akamai, especially with managed services, it really does work well.
Payload Inspection Size
Like Cloudflare, Akamai also inspects a maximum payload size of 128KB. In fact, the default configuration is only 8KB, which must be increased through the configuration.
Like other leading WAAP providers, effectively handling false positives can be challenging with Akamai, especially if you lack certified in-house security engineers or haven’t subscribed to the managed services add-on.
Imperva states that over 90% of WAAP deployments operate in block mode. Apart from AppTrana, which claims 100% in block mode, only Imperva and Fastly mention this figure on their websites.
This is likely due to the efforts of Imperva Research Labs, which conducts thorough testing to minimize false positives before implementing blocking rules. Additionally, Imperva is one of the few WAAP providers that offer Runtime Application Self-Protection (RASP) capabilities.
Here are some of the pros of using Imperva:
Certain industries and government organizations that deal with sensitive data may prefer an on-premise system, and Imperva provides that option. In addition to on-premise solutions, Imperva also offers a cloud-based Web Application Firewall (WAF). Organizations opting for a hybrid WAAP strategy can rely on Imperva’s comprehensive offerings.
Imperva is well known for its seamless integrations with data warehouses, SIEM tools, and various DevOps tools. It offers integrations with popular platforms such as Amazon S3, Elastic, Splunk, Terraform, and more, allowing for smooth connectivity and compatibility.
To further minimize false positives and defend against unknown attack patterns, Imperva provides RASP, a solution that offers advanced protection. RASP can analyze east-west traffic to eliminate insider threats as well effectively.
Imperva supports a wide range of popular runtimes and databases, including Java, Node JS, SQL Server, Oracle, and more, ensuring comprehensive coverage for various applications and environments.
Now let’s discuss the limitations of Imperva.
Managed Services is an Add-On
If you want a managed WAF, you’ll have to subscribe to the managed services that are an add-on. The pricing could be like what Cloudflare charges.
API Discovery is an Add-On
Since the world is moving towards an API economy and API discovery is the #1 challenge when it comes to API security, paying extra for this feature might not be ideal. Other WAAP providers, such as AppTrana, bundle it in the pricing. In fact, the AppTrana license also includes penetration testing of API endpoints, a service that none of the WAAP providers offer.
Fastly, like Imperva, claims that over 90% of WAAP deployments are in block mode. Only AppTrana WAAP has a higher block mode percentage at 100%.
A significant factor contributing to this is Fastly’s proprietary SmartParse technology, which enhances anomaly detection without excessive reliance on signatures.
Fastly is also renowned for its seamless integrations with SIEM tools, Slack, DevOps tools, and more, offering enhanced connectivity and compatibility options.
Here are some of the pros of using Fastly:
Network Learning Exchange (NLX)
Fastly’s NLX is a unique IP reputation feed that utilizes anonymized data from thousands of distributed software agents to identify confirmed malicious activity. NLX identifies attack patterns across Fastly’s customer network, enabling proactive alerts for defending web applications and APIs.
Fastly’s SmartParse is an exclusive technology that evaluates the context and execution of each request to detect malicious or anomalous payloads. SmartParse allows minimal tuning and immediate threat detection, aiming to minimize false positives and provide instant protection.
Flexible Deployment Options
Fastly offers the most versatile deployment options for WAF in the market. It can protect applications in containers, on-premises, in the cloud, or at the edge, all through one integrated solution.
Coming to the limitations of Fastly as a Cloudflare replacement.
Managed Services and Support
Like Cloudflare, Fastly managed services are only available in the ultimate plan. So, you have no option to choose managed services for the starter and advantage plans.
If you want a managed WAF that will help you with virtual patches, DDoS monitoring, latency monitoring, and custom workflow-based bot rules, you have no choice other than the ultimate plan.
Even phone and chat support are only available in the ultimate plan. In addition, the 24/7/365 support for general inquiries is only available in San Francisco, London, or Tokyo business hours.
Given AWS’s leadership position in the public cloud market, AWS WAF is a popular choice for organizations already on AWS.
Here are some of the pros of using AWS WAF:
Flexibility in Deploying Rulesets
Major providers such as Fortinet, F5, and so on provide rulesets for AWS. These offer additional protection over the out-of-the-box rulesets that AWS provides. There’s a nominal subscription fee for using these rules, and you’ll also be billed on the traffic that is inspected through these.
AWS WAF is a complete pay-as-you-go model, and you’ll only get billed for add-ons such as AWS Shield, custom rules, bandwidth, etc.
Here are the cons of using AWS WAF:
AWS Shield Advanced is Expensive
AWS Shield Advanced has a flat billing charge of $3000 per month and is a managed service for DDoS. If you want good DDoS protection, Cloudflare and AppTrana provide unmetered DDoS at a price that is a small fraction of this.
Notably, Cloudflare offers unmetered DDoS protection through an add-on, accompanied by a fee of $.05 for every 10,000 requests. On the other hand, AppTrana seamlessly incorporates unmetered DDoS protection into all plans, eliminating the need for any extra charges.
No Managed Service
AWS doesn’t provide any managed service for WAF outside the DDoS service in AWS Shield.
The only way you can get managed service from AWS for custom rules and false positive monitoring is by entering large five-six figure contracts with system integrators.
If managed WAF is one of the reasons why you are looking for a Cloudflare alternative, then AWS is definitely not the answer.
If you are looking for a managed WAF with a tight budget, AppTrana is your only option.
If you are looking for an alternative because of some application-level challenges that Cloudflare is not able to resolve, you’ll not go wrong with AppTrana, Akamai, Imperva, or Fastly. The key is to start a trial and then see how the firewall works with your specific application.
Even in the above alternatives, AppTrana and Imperva are cost-effective, especially when you want to protect hundreds of applications.