F5 vs Imperva still decides the HTTP request at the edge
Compare managed rules, tuning, deployment, API and bot options, and support for F5 WAF for Distributed Cloud and Imperva Cloud WAF. The monthly request pool and the quote sit in Editions.
Both F5 SaaS packages include 30 million inspected requests a month. The Imperva WAF page opened 3 Oct 2026 does not print a dollar price for Cloud WAF.
The useful split is who writes the rule, how a false positive gets tuned, where the service is deployed, which API and bot lines are on the order, and who answers when a block is wrong. Attaching a WAF object to an HTTP load balancer is one F5 step, not the whole comparison.
The columns are only F5 WAF for Distributed Cloud and Imperva Cloud WAF. Other F5 WAF products and other Imperva WAF deployments are separate orders and are not columns on this page.
Overview
| Primary use case | SaaS web application firewall for public apps on Essentials, and for internal apps as well on Enterprise | SaaS web application firewall with managed rules, for apps reached through the Imperva service |
|---|---|---|
| Managed rules | Default policy applies high and medium accuracy signatures, threat campaigns, and violations. Custom policy can disable attack types, set Block, Report, or Ignore by accuracy, and turn threat campaigns on or off | Imperva Threat Research writes rules for classes such as SQL injection and cross-site scripting, tests them, and pushes them. Daily updates, and real-time updates for critical threats. You can still add policy |
| Tuning | Automatic attack signature tuning is on by default and suppresses false positives with a probabilistic model. New or updated signatures can be staged in monitoring while the firewall stays in blocking mode. Exclusion rules skip a signature, violation, attack type, or bot name for a domain, path, and method | The operating model is vendor-tested rules rather than a signature-by-signature staging screen. Custom policy is still available. Analyst fine-tuning is a value-added service, not the base console flow described on the WAF page |
| License/pricing | Essentials or Enterprise, annual subscription or AWS pay-as-you-go. One marketplace unit has a 12-month price. See Editions | Free trial from the WAF page. No public dollar on that page. Upload scanning is an add-on. See Editions |
| Who operates it | Your team owns the WAF object. F5 hosts the control service. Optional managed services tune WAF, API security, DDoS, and bot defense | Imperva writes and pushes managed rules. Your team works in the console. Optional analyst, enterprise, or named-account services sit on a separate services page |
| Main buying consideration | Will your team tune signatures and staging, or pay a managed-services tier to do that tuning? | Do you want rules the vendor tests and pushes, with price, site count, API and bot lines, and any analyst service written on the order? |
We read the F5 WAF for Distributed Cloud product page, the Distributed Cloud compare page, the billing FAQ last modified 2 Oct 2026, the WAF how-to last modified 2 Oct 2026, the Distributed Cloud support process last modified 2 Oct 2026, the managed-services page, the 20 Apr 2026 packaging post, the Imperva WAF page, the Cloud WAF onboarding notes in the Imperva cloud application security docs, and the Imperva value-added services page, on 3 Oct 2026. We did not attach a WAF, send a request through either service, or sit in either console, so this is not a hands-on bake-off.
F5 WAF for Distributed Cloud
Imperva Cloud WAF
Thales completed the acquisition of Imperva on 4 Dec 2023. The WAF page checked 3 Oct 2026 still sells the product as Imperva, and the cloud option on that page is Imperva Cloud WAF. F5 still sells F5 WAF for Distributed Cloud under F5. The F5 pages checked the same day do not describe a completed sale of the company.
Editions and pricing
On 20 Apr 2026 F5 introduced two annual packages for Distributed Cloud Services: Essentials and Enterprise. Essentials is the public-app package and includes the web application firewall, API protection rules, DDoS mitigation, and content delivery. Enterprise adds internal applications, malware protection, risk-based actions, and client-side defense. Dollar figures below are only the ones with a currency, a unit, a period, and a named product. Imperva’s WAF page has a free trial and no price.
| How you buy it now | Annual subscription, a cloud-marketplace private offer, or AWS pay-as-you-go. Term subscriptions are reviewed quarterly if usage passes the entitlement. Pay-as-you-go bills monthly in arrears. A flex program true-up is annual | Free trial from the WAF page, then a conversation. The page does not show a self-serve checkout price |
|---|---|---|
| Public price (3 Oct 2026) | AWS Marketplace lists F5 Distributed Cloud WAAP at $25,956 USD per unit for a 12-month commitment. The listing calls a unit a committed quantity of that WAAP product. It does not say how many requests that unit includes, so do not treat the unit as the 30 million request pool. Account-specific pricing stays with the F5 account team. This row is a marketplace price, not a named third-party reseller price | Quote-required. No dollar, no per-gigabyte rate, and no trial length on the WAF page opened 3 Oct 2026 |
| Included each month | Essentials: 1 public or distributed load balancer, 100 application rules, 30 million requests, 1 million log lines, 5 TB of CDN transfer. Enterprise: 4 public or distributed load balancers, 1,000 application rules, the same request pool, 50 million log lines, 15 TB of CDN transfer, and 3 medium Customer Edge nodes. Passing a limit does not cut the service off. The account team prices the overage | Not printed. Sites, bandwidth, and requests are part of the quote |
| Outside the base package | Bot Defense is an add-on on the billing FAQ, not part of Essentials or Enterprise. The AWS listing text says the WAAP unit includes bot management. Those two pages disagree. The order has to name which bot coverage you are paying for. Routed DDoS is also an add-on | Upload Scan and Control, announced 23 Feb 2026, is an add-on for Imperva Cloud WAF. That post does not print a price. Advanced Bot Protection is a separate product page |
| Main buying consideration | Match the package to public apps only, or to internal apps plus malware and client-side defense. Get the bot line in writing | Put the dollar, the site count, the API and bot lines, and the upload add-on on the order. The public page will not supply them |
Deployment and enforcement
Both services can inspect HTTP before the origin answers. They do not require the same box in front of the app.
| Where it runs | F5 global points of presence, a public cloud, or a Customer Edge node in your environment. The product page lists all three. AI features on a Customer Edge require AVX on that hardware. Without AVX, those AI features cannot run | Imperva’s cloud service, managed in the Imperva Management Console. Onboarding docs show the DNS records Imperva issues for the site, including a CNAME path. The docs say that CNAME domain structure should not be treated as a stable automation target |
|---|---|---|
| What you attach | A WAF object on an HTTP or HTTPS load balancer, per the how-to last modified 2 Oct 2026. Enforcement mode is Blocking or Monitoring, and it overrides the load balancer setting for that traffic. A different WAF policy can be attached to one route | The site in the console. Terraform can provision Cloud WAF. A fixed DNS recipe was not printed on the marketing page. The records come back from onboarding |
| Block or challenge | Blocking logs and blocks. Monitoring logs without blocking. Enterprise adds risk-based actions, including a challenge. With Enhance with AI, the default is to block only high-risk requests. Medium-risk blocking is a separate switch | The WAF page argues for blocking mode from the start. The same page says more than 94% of customers deploy in blocking mode, and later says over 90%. Both figures are Imperva’s |
| Response controls | Data Guard can mask values such as card numbers in HTTP responses. Log masking for sensitive parameters is on by default and can be customized. A custom blocking page can set the response code and body | The WAF page ties logging and access controls to GDPR, PCI DSS, and similar regimes. A mask-the-response control was not found on that page in this research. That is a docs gap, not a claim that the control is absent |
| Main buying consideration | Do you need inspection on a node you place, with staging so a new signature does not block on day one? | Is a vendor-pushed rule, already tested, the operating model you want, with DNS cutover handled from the onboarding records? |
Rules, tuning, API, bots, and support
F5’s compare page describes a signature engine with over 8,500 signatures, covering CVEs and bot signatures from F5 Labs. Imperva does not print a signature total on the WAF page. It describes managed rules tested before they are pushed.
| API options | Essentials includes API protection rules. Enterprise adds enterprise API discovery, per the billing FAQ. The WAF object itself is the app firewall, not a separate API product | The Cloud WAF page says the service integrates API security. Whether API Security is its own order line was not on that page. Not found in this research, so this cell does not say the other product lacks it |
|---|---|---|
| Bot options | Signature-based bot protection is on the WAF object. The default blocks a malicious bot and only reports good and suspicious bots. Custom sets Block, Report, or Ignore per class. Behavioral Bot Defense, including account-takeover controls, is the add-on outside both packages | The Cloud WAF description says the service integrates bot protection. Advanced Bot Protection is a separate product, with its own analyst add-on for setup and tuning. A bot-only product is outside these columns |
| File upload | Malware Protection is an Enterprise service. The included pool is 1 million scan transactions a month | Upload Scan and Control is the 23 Feb 2026 add-on. It blocks a suspicious file at the edge. No transaction cap is printed |
| Support | Distributed Cloud support is 24 hours a day, by console, phone, or support@cloud.f5.com. P1, service down with no workaround, is phone-only. The managed-services page lists Standard, Enhanced, and Enhanced+ human-response targets of 60, 30, and 15 minutes for non-P1 issues, and a 15-minute first response for P1 on every tier. Those tiers also tune WAF, API security, DDoS, and bot defense. FQDN setup counts differ by tier and were not copied here as a price | The value-added services page lists Security Analyst Services for policy fine-tuning and incident help, Enterprise Services for 24×7 operational monitoring, and a named technical account manager with a designated support engineer. A public minute-by-minute response table for base Cloud WAF support was not on that page |
| Main buying consideration | Is signature tuning plus a counted malware pool enough, or does the order also need Bot Defense and a managed-services tier? | Are managed rules the base, with upload scanning, Advanced Bot Protection, and analyst time priced as extra lines? |
That comment is a shopper on a grocery site, not a console note. Imperva WAF challenged the browser, more than once, and did not simply block it. A blocking-mode percentage on the vendor page is a different outcome from a challenge loop in front of a real checkout.
Where they overlap
Either service can sit in front of an origin and inspect the HTTP request for the usual web-attack classes. Both describe Layer 7 DDoS controls in the cloud service. Both can be provisioned with Terraform. Both describe bot controls alongside the cloud WAF, with F5’s behavioral Bot Defense and Imperva’s Advanced Bot Protection left as separate orders.
Overlap is shared coverage, not a reason to put both products on one hostname. Two proxies on the same name means two decisions about the same request, and the origin only sees what both allowed. Use two services when they own different hostnames, or during a short move from one front door to the other.
When to use both
Run both only with a written owner for each name. A new public app on F5 WAF for Distributed Cloud can sit next to an existing app already on Imperva Cloud WAF if each certificate and each block page names one service. Pointing both at one origin, so either might block, is a migration window. End the window by picking the service that owns the request.
Choose Imperva Cloud WAF when managed rules should be written and pushed for you, a free trial is enough to start, and the order will carry the price, the site count, the API and bot lines, and any analyst service. Choose F5 WAF for Distributed Cloud when you want a WAF object with signature tuning and staging, Essentials or Enterprise matches the monthly pool in Editions, and inspection can run at an F5 point of presence or on a Customer Edge node, with a named support tier if your team will not tune it.
FAQs
Which products are in the columns?
F5 WAF for Distributed Cloud and Imperva Cloud WAF. Other F5 WAF products and other Imperva WAF deployments are separate orders and are not columns here.
What should the order say about price?
Editions is the only place the dollar figure and the monthly pools appear. The AWS figure is $25,956 USD per unit of F5 Distributed Cloud WAAP for a 12-month commitment, and it is not the 30 million request pool. Imperva’s price, site count, and upload add-on are quote-required.
Do both stop a request before the origin?
They can. F5 uses a WAF object on an HTTP load balancer, at a point of presence or a Customer Edge node, in Blocking or Monitoring. Imperva Cloud WAF applies managed rules in the Imperva service after the onboarding DNS change. Sharing one hostname is the overlap case, not a second control you need by default.
Who tunes a false positive?
On F5, automatic signature tuning is on by default, signatures can be staged, and exclusion rules skip a signature or attack type for a path. Managed-services tiers can take that tuning. On Imperva, Threat Research tests and pushes managed rules, and you can still add policy. Analyst fine-tuning is a value-added service. A minute-level support table for base Imperva support was not on the services page checked 3 Oct 2026.
Are these still the names on the order?
Yes. The WAF page still uses Imperva, and the cloud option is Imperva Cloud WAF. F5 still sells F5 WAF for Distributed Cloud under F5. The ownership sentence above is the only acquisition note.
Is this a hands-on bake-off?
No. The comparison uses F5 and Imperva pages opened 3 Oct 2026, including the billing FAQ, the WAF how-to, the support pages, and the Cloud WAF trial note, plus one Hacker News comment from 3 Jan 2025. Nobody attached a WAF or sent a request through either service.
