CISO Tribune

Vendor comparison · 2 companies

Cloudflare vs Imperva

Cloudflare sells one platform for apps, agents and workforce. Imperva sells an Application Security Platform that protects against application and API attacks without impacting legitimate users. CISO Tribune files both under DDoS protection and WAF and WAAP. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Cloudflare
  • Imperva
Cloudflare vs Imperva: Products, Customers and Funding Compared
CloudflareCloudflare sells one platform for apps, agents and workforce.cloudflare.comImpervaImperva sells an Application Security Platform that protects against application and API attacks without impacting legitimate users.imperva.com
What it sells
  • DDoS Protection[11][12][13][25][26]DDoS protection backed by 500 Tbps of network capacity.
  • Magic Transit[12][13]DDoS protection for networks at layers 3 and 4.
  • Spectrum[12][13]DDoS protection for TCP/UDP applications.
  • Bot Management[11][21][22][25]Custom machine learning models for each bot management customer.
  • RealtimeKit[24]A toolkit for real-time audio and video communication.
  • Web Application Firewall (WAF)[9][12]Imperva WAF protects applications in any environment, cloud or on-premises.
  • Advanced Bot Protection[4][5][9][11][17]Imperva Advanced Bot Protection protects websites, mobile apps and APIs from sophisticated automated attacks.
  • API Security[4][5][9][17]Imperva API Security provides continuous protection of all APIs.
  • DDoS Protection[5][9][12]Imperva’s advanced DDoS protection defends against volumetric, protocol-based and Layer 7 attacks.
  • Client-Side Protection[9][13]Imperva Client-Side Protection safeguards against client-side attacks like formjacking, digital skimming and Magecart.
  • AI Application Security[5][14]Imperva AI Application Security is engineered for the unique architecture of LLMs.
  • Data Security Fabric[15]Imperva Data Security Fabric is purpose-built for hybrid multicloud environments.
  • Content Delivery Network[9]Imperva's Secure Content Delivery Network (CDN) accelerates the delivery of content and applications.
Categories
Headquarters
San Francisco, United States[3][28]Redwood Shores, United States[3]
Founded
2009[4]Not stated on its pages
Ownership and funding
Public (NYSE: NET)[2][10][19][20][28][31][32]Owned by Thales[1][5][7][8][10]
Named customers
  • Canva[5]
  • Discord[6]
  • Shopify[7]
  • Lawrence Berkeley National Laboratory[8]
Not stated on its pages
Recent news
  • October 9, 2026Cloudflare announced that the Deno team is joining the company, with the stated aim of simplifying self-hosting of Workers and Durable Objects.[18]
  • August 6, 2026Cloudflare reported second-quarter 2026 revenue of $696.1 million, up 36% year over year.[9]
  • June 4, 2026Cloudflare acquired VoidZero, the open source company behind the Vite JavaScript build tooling ecosystem.[10]
  • May 7, 2026Cloudflare reported first-quarter 2026 revenue of $639.8 million, up 34% year over year.[2]
  • April 14, 2026Cloudflare announced Cloudflare Mesh, a private networking solution built for AI agents.[32]
  • August 24, 2026Thales Imperva introduced the SSL Integration Center, a framework connecting Imperva Cloud WAF with certificate lifecycle management platforms, launching with a DigiCert integration.[19]
  • August 3, 2026Thales launched Imperva for AWS, which provides web application, API and bot protection for AWS environments.[6]
G2 and Gartner Peer Insights
  • G2: Not stated on its pages
  • Gartner Peer Insights: listed, seen November 3, 2026[20]
  • G2: listed, seen November 6, 2026[7]
  • Gartner Peer Insights: listed, seen November 6, 2026[8]
Who it fits
From its own pages, Cloudflare sells to organizations from startups to the world's largest enterprises. Cloudflare describes its security platform as serving organizations from startup to enterprise. Cloudflare addresses developers building frontend applications, from static sites to complex web apps. Cloudflare works with managed service partners that serve small to midsize organizations. Cloudflare works with global partners serving the Large Enterprise segment.From its own pages, Imperva sells mainly to organizations that need to protect applications and APIs in public or private cloud, hybrid and on-premises environments. Imperva addresses retail organizations that need to protect customers' data and secure applications, APIs, and cloud networks. Imperva addresses businesses aiming to comply with PCI DSS 4.0 standards while defending against client-side attacks. Imperva describes support for compliance in highly regulated industries across hybrid and multicloud environments. Imperva describes a purpose-built solution to secure AI applications for homegrown GenAI.
Last verified
October 10, 2026September 27, 2026

Where they overlap

  • Cloudflare and Imperva are both filed under DDoS protection and WAF and WAAP.
  • Both are headquartered in the United States.

Where they differ, field by field

  • Cloudflare's primary category is DDoS protection; Imperva's is WAF and WAAP.
  • Cloudflare is also filed under SASE and SSE and DNS security. Imperva is also filed under API security and Bot and abuse management.
  • Cloudflare lists DDoS Protection, Magic Transit, Spectrum, Bot Management and RealtimeKit. Imperva lists Web Application Firewall (WAF), Advanced Bot Protection, API Security, DDoS Protection, Client-Side Protection and 3 more.
  • Cloudflare is headquartered in San Francisco, United States. Imperva is headquartered in Redwood Shores, United States.
  • Cloudflare was founded in 2009.
  • Cloudflare is a public company listed on NYSE as NET. Imperva is owned by Thales.
  • Cloudflare publicly names Canva, Discord, Shopify and Lawrence Berkeley National Laboratory.

What it sells: Cloudflare

What DDoS Protection does[11][12][13][25][26]
Cloudflare says its DDoS protection absorbs the largest attacks with 500 Tbps of network capacity. Cloudflare offers 24/7 email and phone support, including an Under Attack hotline.
What Spectrum does[12][13]
Cloudflare Spectrum provides DDoS protection for TCP/UDP applications. Spectrum covers applications built with any protocols, including custom protocols.
What Bot Management does[11][21][22][25]
Cloudflare built a platform to deploy custom machine learning models for every bot management customer. Super Bot Fight Mode includes bot protection for Pro, Business and all Enterprise customers.
What RealtimeKit does[24]
RealtimeKit handles WebRTC complexities, connection management and global routing. RealtimeKit Agents supports building voice bots, interactive assistants and automated support systems.

What it sells: Imperva

What Web Application Firewall (WAF) does[9][12]
Imperva says managed rules written and tested by the Imperva Threat Research team before deployment allow more than 94% of Imperva customers to deploy the Imperva WAF in blocking mode. Imperva’s Attack Analytics automatically correlates thousands of security alerts into narratives. Imperva’s Terraform provider automates Cloud WAF deployments.
What Advanced Bot Protection does[4][5][9][11][17]
Advanced Bot Protection safeguards websites, mobile apps and APIs from bot attacks, including all OWASP 21 Automated Threats. Imperva says its multi-layered approach detects malicious bots by combining direct client interrogation, behavior analysis, machine learning, connection characteristics and threat intelligence feeds.
What DDoS Protection does[5][9][12]
Imperva offers a guaranteed 3-second mitigation SLA for Layers 3 and 4 DDoS attacks. Imperva DDoS Protection for Networks shields entire infrastructures with 13 Tbps of multi-terabit scrubbing capacity. Imperva DDoS Protection for Websites works alongside a cloud web application firewall (WAF) to block attacks and malicious bots.
What Client-Side Protection does[9][13]
Imperva Client-Side Protection enables security teams to manage client-side resources and JavaScript while streamlining compliance with PCI DSS 4.0 requirements 6.4.3 and 11.6.1. Client-Side Protection automatically blocks known malicious domains based on data from the Imperva Threat Research Team.
What Data Security Fabric does[15]
Imperva Data Security Fabric protects all your data assets. Imperva data security reveals critical insight including sensitive data location, users, access, and risk. Imperva offers out-of-the-box support for over 100 data repositories, on-prem or in cloud.

Questions about Cloudflare and Imperva

What do Cloudflare and Imperva sell?
Cloudflare sells DDoS Protection, Magic Transit, Spectrum, Bot Management and RealtimeKit. Imperva sells Web Application Firewall (WAF), Advanced Bot Protection, API Security, DDoS Protection, Client-Side Protection and 3 more.
Are Cloudflare and Imperva in the same category?
They share DDoS protection and WAF and WAAP. Cloudflare's primary category is DDoS protection and Imperva's is WAF and WAAP.
Where are Cloudflare and Imperva headquartered?
Cloudflare is headquartered in San Francisco, United States. Imperva is headquartered in Redwood Shores, United States.
When were Cloudflare and Imperva founded?
Cloudflare was founded in 2009.
Who owns Cloudflare and Imperva?
Cloudflare is a public company listed on NYSE as NET. Imperva is owned by Thales.
Which customers do Cloudflare and Imperva name?
Cloudflare publicly names Canva, Discord, Shopify and Lawrence Berkeley National Laboratory.
Who are Cloudflare and Imperva sold to?
From its own pages, Cloudflare sells to organizations from startups to the world's largest enterprises. From its own pages, Imperva sells mainly to organizations that need to protect applications and APIs in public or private cloud, hybrid and on-premises environments.
What have Cloudflare and Imperva announced recently?
October 9, 2026: Cloudflare announced that the Deno team is joining the company, with the stated aim of simplifying self-hosting of Workers and Durable Objects. August 24, 2026: Thales Imperva introduced the SSL Integration Center, a framework connecting Imperva Cloud WAF with certificate lifecycle management platforms, launching with a DigiCert integration.

About Cloudflare

Cloudflare sells one platform for apps, agents and workforce. Cloudflare describes one network for workloads and security, close to users and close to data. Cloudflare says security, connectivity and code run in 335+ cities around the world, within 50ms of 95% of the world's population. Cloudflare says DDoS protection, WAF, bot management and Zero Trust controls are built into the network and run on every request from day one. Cloudflare says every site gets the same DDoS mitigation, the same global CDN and the same network at every tier.[1][11][21]

On DDoS defense, Cloudflare says its DDoS protection absorbs the largest attacks with 500 Tbps of network capacity. Cloudflare Spectrum provides DDoS protection for TCP/UDP applications. Spectrum covers applications built with any protocols, including custom protocols. Magic Transit protects networks, data centers and infrastructure against layer 3 and 4 DDoS attacks. Cloudflare says Anycast absorbs and auto-routes traffic, with mitigations that trigger in seconds and no manual tuning. Cloudflare offers 24/7 email and phone support, including an Under Attack hotline.[12][13][21]

For application security, Cloudflare says customers can deploy WAF, rate-limiting, mTLS and Bot Management with a single DNS change, with no agents and no appliances. Cloudflare says one API and dashboard covers edge rules, logs and analytics, and integrates with CI/CD for policy-as-code. Cloudflare says schema validation and mTLS protect REST/GraphQL traffic and enforce client identity, with no SDK required. Cloudflare offers free, auto-renewed certificates and modern transport. Cloudflare provides real-time dashboards plus raw logs to R2/S3/SIEM. Cloudflare says it can detect Magecart-style client-side tampering before customers' card data leaks. Cloudflare says its security platform protects 20% of the Internet.[21]

On bot defense, Cloudflare built a platform to deploy custom machine learning models for every bot management customer. Cloudflare says Super Bot Fight Mode includes bot protection for Pro, Business and all Enterprise customers, and Enterprise Bot Management is the other bot option named.[22]

For workforce security, Cloudflare says internal apps and developer tools can be protected with identity-based access, device posture checks and single sign-on, with no VPN required. Cloudflare says its Zero Trust platform connects and secures users, devices and data, with the first 50 employees free and a flat per-user rate beyond that.[11][21]

Cloudflare also serves developers who build applications. Cloudflare says customers can bring any JavaScript framework or build tool, connect a git repository and deploy a project to a single Worker serving both front-end and back-end. Cloudflare supports Next.js, Hono, React Router, TanStack, Remix, Astro, Nuxt and RedwoodJS. Cloudflare says it charges only for compute, not wall time, even during long agent workflows or hibernating WebSockets. RealtimeKit handles WebRTC complexities, connection management and global routing. RealtimeKit Agents supports building voice bots, interactive assistants and automated support systems.[11][23][24]

Among customers, Shopify powers commerce for millions of merchants and businesses. Shopify uses the Cloudflare WAF, Bot Management, DDoS Protection and Gateway. Cloudflare says the log-only rules in that setup let Shopify preview the impact of security changes before they reach production. Cloudflare works with partners as well: it expanded its worldwide reseller partnership with Rackspace Technology to include managed services offerings. Cloudflare says the Rackspace service includes onboarding support for Cloudflare Managed DNS, Content Delivery Network, Advanced DDoS Protection and Web Application Firewall.[11][25][26][27]

Cloudflare, Inc says its suite of products protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Cloudflare is headquartered in San Francisco, CA, with offices in Austin, TX, Champaign, IL, New York, NY, San Jose, CA, Seattle, WA, Washington, D.C., Toronto, Dubai, Lisbon, London, Munich, Paris, Beijing, Singapore, Sydney and Tokyo. Cloudflare Radar is powered by data from Cloudflare's global network and from aggregated and anonymized data from Cloudflare's 1.1.1.1 public DNS Resolver.[1][11][12][13][14][15][16][17][23][27]

Cloudflare on the record

Sources

Cloudflare full record

  1. [1]cloudflare.comCloudflare · cloudflare.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Cloudflare announces first quarter 2026 financial resultsCloudflare · cloudflare.com · published May 7, 2026 · Tier A
  3. [3]About overviewCloudflare · cloudflare.com · undated page, accessed September 27, 2026 · Tier A
  4. [4]Technologys promise def con china 1 0 highlightsCloudflare · blog.cloudflare.com · published June 5, 2019 · Tier A
  5. [5]CanvaCloudflare · cloudflare.com · undated page, accessed October 10, 2026 · Tier A
  6. [6]DiscordCloudflare · cloudflare.com · undated page, accessed October 10, 2026 · Tier A
  7. [7]ShopifyCloudflare · cloudflare.com · undated page, accessed October 10, 2026 · Tier A
  8. [8]Lawrence berkeley national laboratoryCloudflare · cloudflare.com · undated page, accessed October 10, 2026 · Tier A
  9. [9]Cloudflare announces second quarter 2026 financial resultsCloudflare · cloudflare.com · published August 6, 2026 · Tier A
  10. [10]Cloudflare acquires voidzero to build the future of the ai native webCloudflare · cloudflare.com · published June 4, 2026 · Tier A
  11. [11]Cloudflare: Build for the agent eraCloudflare · undated page, accessed October 23, 2026 · Tier A
  12. [12]Cloudflare DDoS Protection & Mitigation SolutionsCloudflare · undated page, accessed October 23, 2026 · Tier A
  13. [13]Magic Transit - Unmatched DDoS Protection for NetworksCloudflare · undated page, accessed October 23, 2026 · Tier A
  14. [14]US Privacy Law Compliance FAQs | CloudflareCloudflare · undated page, accessed October 23, 2026 · Tier A
  15. [15]Cloudflare Stream - All-in-one Video PlatformCloudflare · undated page, accessed October 23, 2026 · Tier A
  16. [16]Cloudflare Artifacts - Versioned Git-compatible storage for agentsCloudflare · undated page, accessed October 23, 2026 · Tier A
  17. [17]Cloudflare AI Search - Automatic RAG infrastructure and queryingCloudflare · undated page, accessed October 23, 2026 · Tier A
  18. [18]Posts tagged "Acquisitions" — Cloudflare BlogCloudflare Blog · published October 9, 2026 · Tier A
  19. [19]Cloudflare Application Security and Performance Reviews 2026 - G2G2 · undated page, accessed October 23, 2026 · Tier C
  20. [20]Cloudflare Reviews, Ratings & Features 2026 | Gartner Peer InsightsGartner Peer Insights · undated page, accessed October 23, 2026 · Tier C
  21. [21]Web Security Platform - WAF, DDoS Protection, Bot ManagementCloudflare · undated page, accessed November 3, 2026 · Tier A
  22. [22]Building unique, per-customer defenses against advanced bot threats in the AI era | Cloudflare BlogCloudflare Blog · undated page, accessed November 3, 2026 · Tier A
  23. [23]Frontend Development PlatformCloudflare · undated page, accessed November 3, 2026 · Tier A
  24. [24]Cloudflare RealtimeKit - Voice, Video & Multimodal AppsCloudflare · undated page, accessed November 3, 2026 · Tier A
  25. [25]Shopify & Cloudflare | Customer StoryCloudflare · undated page, accessed November 3, 2026 · Tier A
  26. [26]Cloudflare and Rackspace Technology Expand Partnership with Managed Services | Cloudflare BlogCloudflare Blog · undated page, accessed November 3, 2026 · Tier A
  27. [27]Cloudflare Partner Program Now Supports SASE & Zero Trust Managed Services | Cloudflare BlogCloudflare Blog · undated page, accessed November 3, 2026 · Tier A
  28. [28]About | Cloudflare RadarCloudflare Radar · undated page, accessed November 3, 2026 · Tier A
  29. [29]Cloudflare to Acquire Replicate to Build the Most Seamless AI Cloud for DevelopersCloudflare · published November 17, 2025 · Tier A
  30. [30]Cloudflare Acquires Astro to Accelerate the Future of High-Performance Web DevelopmentCloudflare · published January 16, 2026 · Tier A
  31. [31]Cloudflare Strengthens Content Offering to AI Companies with Acquisition of Human NativeCloudflare · published January 15, 2026 · Tier A
  32. [32]Cloudflare Launches Mesh to Secure the AI Agent LifecycleCloudflare · published April 14, 2026 · Tier A

Imperva full record

  1. [1]Thales completes acquisition imperva creating global leaderThales Group · thalesgroup.com · published December 4, 2023 · Tier A
  2. [2]AboutImperva · imperva.com · undated page, accessed September 27, 2026 · Tier A
  3. [3]Greg clark joins imperva board of directorsImperva · imperva.com · published June 4, 2014 · Tier A
  4. [4]Application securityImperva · imperva.com · published August 23, 2026 · Tier A
  5. [5]Cyber Security Leader | Imperva, Inc.Imperva · undated page, accessed October 25, 2026 · Tier A
  6. [6]Thales Launches Imperva for AWS to Help Organizations Protect Applications and APIsBusiness Wire · published August 3, 2026 · Tier A
  7. [7]Imperva Data Security Fabric Reviews & Product Details - G2G2 · undated page, accessed October 25, 2026 · Tier C
  8. [8]Thales Group (Imperva) Reviews - Gartner Peer InsightsGartner Peer Insights · undated page, accessed October 25, 2026 · Tier C
  9. [9]Best Application Security | Imperva WAAP ProtectionImperva · undated page, accessed November 6, 2026 · Tier A
  10. [10]Web Application Firewall (WAF) | Cloud & On-Prem | ImpervaImperva · undated page, accessed November 6, 2026 · Tier A
  11. [11]Advanced Bot Protection | Stop Advanced Bots | ImpervaImperva · undated page, accessed November 6, 2026 · Tier A
  12. [12]Advanced DDoS Protection & Mitigation Services | ImpervaImperva · undated page, accessed November 6, 2026 · Tier A
  13. [13]Client-Side Protection | PCI 4.0 Compliance | ImpervaImperva · undated page, accessed November 6, 2026 · Tier A
  14. [14]Enterprise AI & LLM Security | Stop Prompt Injection | ImpervaImperva · undated page, accessed November 6, 2026 · Tier A
  15. [15]Data Security Solutions | Protecting Data Everywhere | ImpervaImperva · undated page, accessed November 6, 2026 · Tier A
  16. [16]Plans and Services | Imperva Cyber SecurityImperva · undated page, accessed November 6, 2026 · Tier A
  17. [17]Retail & eCommerce Cyber Security | Secure Online Transactions | ImpervaImperva · undated page, accessed November 6, 2026 · Tier A
  18. [18]Data Security Fabric | Protect All Data Types | ImpervaImperva · undated page, accessed November 6, 2026 · Tier A
  19. [19]Bring Your Own CA: Introducing the Thales Imperva SSL Integration Center, Featuring DigiCert Trust Lifecycle ManagerImperva · published August 24, 2026 · Tier A

Spot a factual error? Request a correction.