CISO Tribune

Vendor comparison · 2 companies

Imperva vs StackHawk

Imperva sells an Application Security Platform that protects against application and API attacks without impacting legitimate users. StackHawk sells two plans, Wingman and StackHawk Scale, that run on HawkScan, a runtime testing engine for running applications. CISO Tribune files both under API security. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Imperva
  • StackHawk
Imperva vs StackHawk: Products, Customers and Funding Compared
ImpervaImperva sells an Application Security Platform that protects against application and API attacks without impacting legitimate users.imperva.comStackHawkStackHawk sells two plans, Wingman and StackHawk Scale, that run on HawkScan, a runtime testing engine for running applications.stackhawk.com
What it sells
  • Web Application Firewall (WAF)[9][12]Imperva WAF protects applications in any environment, cloud or on-premises.
  • Advanced Bot Protection[4][5][9][11][17]Imperva Advanced Bot Protection protects websites, mobile apps and APIs from sophisticated automated attacks.
  • API Security[4][5][9][17]Imperva API Security provides continuous protection of all APIs.
  • DDoS Protection[5][9][12]Imperva’s advanced DDoS protection defends against volumetric, protocol-based and Layer 7 attacks.
  • Client-Side Protection[9][13]Imperva Client-Side Protection safeguards against client-side attacks like formjacking, digital skimming and Magecart.
  • AI Application Security[5][14]Imperva AI Application Security is engineered for the unique architecture of LLMs.
  • Data Security Fabric[15]Imperva Data Security Fabric is purpose-built for hybrid multicloud environments.
  • Content Delivery Network[9]Imperva's Secure Content Delivery Network (CDN) accelerates the delivery of content and applications.
  • Wingman[15][16]Runs inside a coding agent and tests the running app.
  • StackHawk Scale[15][16]The plan for security teams covering every app in the organization.
  • HawkScan[3][15]The runtime testing engine that tests the running application with real requests.
Categories
Headquarters
Redwood Shores, United States[3]Not stated on its pages
Founded
Not stated on its pagesNot stated on its pages
Ownership and funding
Owned by Thales[1][5][7][8][10]Not stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • August 24, 2026Thales Imperva introduced the SSL Integration Center, a framework connecting Imperva Cloud WAF with certificate lifecycle management platforms, launching with a DigiCert integration.[19]
  • August 3, 2026Thales launched Imperva for AWS, which provides web application, API and bot protection for AWS environments.[6]
  • April 30, 2026StackHawk connected its scan findings to Wiz, where they are synced automatically and shown as enrichment data on the Attack Surface Findings page.[12]
  • December 16, 2025StackHawk launched Business Logic Testing, automated multi-user authorization testing aimed at BOLA, BFLA and privilege escalation vulnerabilities.[14]
  • November 20, 2025StackHawk announced an integration that correlates findings from Endor Labs' SAST with StackHawk DAST findings.[13]
G2 and Gartner Peer Insights
  • G2: listed, seen November 6, 2026[7]
  • Gartner Peer Insights: listed, seen November 6, 2026[8]
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, Imperva sells mainly to organizations that need to protect applications and APIs in public or private cloud, hybrid and on-premises environments. Imperva addresses retail organizations that need to protect customers' data and secure applications, APIs, and cloud networks. Imperva addresses businesses aiming to comply with PCI DSS 4.0 standards while defending against client-side attacks. Imperva describes support for compliance in highly regulated industries across hybrid and multicloud environments. Imperva describes a purpose-built solution to secure AI applications for homegrown GenAI.Application security and product security teams that need coverage across every app and API are named as buyers, and the Scale plan is for security teams covering every app in the organization. The industries named are financial services, health tech, insurance, media, transportation, education technology, and cloud analytics. Scans are described as fitting into any pipeline and any environment, with no vendor cloud.
Last verified
September 27, 2026November 2, 2026

Where they overlap

  • Imperva and StackHawk are both filed under API security.

Where they differ, field by field

  • Imperva's primary category is WAF and WAAP; StackHawk's is Dynamic application security testing.
  • Imperva is also filed under Bot and abuse management and DDoS protection.
  • Imperva lists Web Application Firewall (WAF), Advanced Bot Protection, API Security, DDoS Protection, Client-Side Protection and 3 more. StackHawk lists Wingman, StackHawk Scale and HawkScan.
  • Imperva is headquartered in Redwood Shores, United States.
  • Imperva is owned by Thales.

What it sells: Imperva

What Web Application Firewall (WAF) does[9][12]
Imperva says managed rules written and tested by the Imperva Threat Research team before deployment allow more than 94% of Imperva customers to deploy the Imperva WAF in blocking mode. Imperva’s Attack Analytics automatically correlates thousands of security alerts into narratives. Imperva’s Terraform provider automates Cloud WAF deployments.
What Advanced Bot Protection does[4][5][9][11][17]
Advanced Bot Protection safeguards websites, mobile apps and APIs from bot attacks, including all OWASP 21 Automated Threats. Imperva says its multi-layered approach detects malicious bots by combining direct client interrogation, behavior analysis, machine learning, connection characteristics and threat intelligence feeds.
What DDoS Protection does[5][9][12]
Imperva offers a guaranteed 3-second mitigation SLA for Layers 3 and 4 DDoS attacks. Imperva DDoS Protection for Networks shields entire infrastructures with 13 Tbps of multi-terabit scrubbing capacity. Imperva DDoS Protection for Websites works alongside a cloud web application firewall (WAF) to block attacks and malicious bots.
What Client-Side Protection does[9][13]
Imperva Client-Side Protection enables security teams to manage client-side resources and JavaScript while streamlining compliance with PCI DSS 4.0 requirements 6.4.3 and 11.6.1. Client-Side Protection automatically blocks known malicious domains based on data from the Imperva Threat Research Team.
What Data Security Fabric does[15]
Imperva Data Security Fabric protects all your data assets. Imperva data security reveals critical insight including sensitive data location, users, access, and risk. Imperva offers out-of-the-box support for over 100 data repositories, on-prem or in cloud.

What it sells: StackHawk

What Wingman does[15][16]
Wingman runs inside the coding agent that engineers already use. When the agent finishes a feature, Wingman tests the running app with HawkScan, hands the findings to the same agent, and rescans after the fix.
What StackHawk Scale does[15][16]
StackHawk Scale adds attack surface discovery and program reporting for security teams. StackHawk Scale is priced by team, not by usage.
What HawkScan does[3][15]
HawkScan tests the running application with real requests. StackHawk scans run as a CLI or Docker container that spins up and shuts down per scan. StackHawk scan configuration is YAML config-as-code, versioned alongside the app.

Questions about Imperva and StackHawk

What do Imperva and StackHawk sell?
Imperva sells Web Application Firewall (WAF), Advanced Bot Protection, API Security, DDoS Protection, Client-Side Protection and 3 more. StackHawk sells Wingman, StackHawk Scale and HawkScan.
Are Imperva and StackHawk in the same category?
They share API security. Imperva's primary category is WAF and WAAP and StackHawk's is Dynamic application security testing.
Where are Imperva and StackHawk headquartered?
Imperva is headquartered in Redwood Shores, United States.
Who owns Imperva and StackHawk?
Imperva is owned by Thales.
Who are Imperva and StackHawk sold to?
From its own pages, Imperva sells mainly to organizations that need to protect applications and APIs in public or private cloud, hybrid and on-premises environments. Application security and product security teams that need coverage across every app and API are named as buyers, and the Scale plan is for security teams covering every app in the organization.
What have Imperva and StackHawk announced recently?
August 24, 2026: Thales Imperva introduced the SSL Integration Center, a framework connecting Imperva Cloud WAF with certificate lifecycle management platforms, launching with a DigiCert integration. April 30, 2026: StackHawk connected its scan findings to Wiz, where they are synced automatically and shown as enrichment data on the Attack Surface Findings page.

About Imperva

Imperva sells an Application Security Platform that protects against application and API attacks without impacting legitimate users. Imperva Web Application Firewall (WAF) protects applications in any environment. Imperva Advanced Bot Protection protects websites, mobile apps and APIs from sophisticated automated attacks without impacting legitimate users.[4][9]

Imperva API Security provides continuous protection of all APIs using deep discovery and classification of sensitive data. Imperva DDoS Protection automatically mitigates DDoS attacks, safeguarding applications and networks while minimizing downtime. Imperva Client-Side Protection safeguards against client-side attacks like formjacking, digital skimming and Magecart and streamlines regulatory compliance with PCI DSS 4.0. Imperva's Secure Content Delivery Network (CDN) accelerates the delivery of content and applications while protecting against attacks.[9][13]

Imperva WAF protects applications in any environment, cloud or on-premises, and offers automated policy creation. Imperva says managed rules written and tested by the Imperva Threat Research team before deployment allow more than 94% of Imperva customers to deploy the Imperva WAF in blocking mode. Imperva’s Attack Analytics automatically correlates thousands of security alerts into narratives. Imperva’s Terraform provider automates Cloud WAF deployments.

Advanced Bot Protection safeguards websites, mobile apps and APIs from bot attacks, including all OWASP 21 Automated Threats. Imperva says its multi-layered approach detects malicious bots by combining direct client interrogation, behavior analysis, machine learning, connection characteristics and threat intelligence feeds. Imperva’s advanced DDoS protection defends against volumetric, protocol-based and Layer 7 attacks, with a 3-second SLA. Imperva offers a guaranteed 3-second mitigation SLA for Layers 3 and 4 DDoS attacks. Imperva DDoS Protection for Networks shields entire infrastructures with 13 Tbps of multi-terabit scrubbing capacity. Imperva DDoS Protection for Websites works alongside a cloud web application firewall (WAF) to block attacks and malicious bots.[11][12]

Imperva Client-Side Protection enables security teams to manage client-side resources and JavaScript while streamlining compliance with PCI DSS 4.0 requirements 6.4.3 and 11.6.1. Client-Side Protection automatically blocks known malicious domains based on data from the Imperva Threat Research Team. Client-Side Protection deployment uses the Imperva Cloud Application Security solution, with a fast detection process that starts within minutes. Imperva AI Application Security is engineered for the unique architecture of LLMs. AI Application Security operates as a SaaS reverse proxy positioned between applications and Large Language Models.[13][14]

Imperva Data Security Fabric is purpose-built for hybrid multicloud environments. Imperva provides centralized data security across legacy and modern cloud environments. Imperva data security reveals critical insight including sensitive data location, users, access, and risk. Imperva data security offers over 260 built-in integrations on an open platform to speed investigation and response. Imperva offers out-of-the-box support for over 100 data repositories, on-prem or in cloud.[15][16][18]

BSE uses Imperva Application Security and Imperva Data Security to help fortify its applications, APIs and data. Imperva Web Application Firewall, Advanced Bot Protection and API Security work together to stop malicious automation and protect retail business logic. Imperva Data Risk Analytics helps retailers comply with GDPR and CCPA requirements by using machine learning to identify suspicious data access. Imperva Cloud Security supports PCI and GDPR compliance mandates.[2][14][17]

Imperva on the record

Sources

Imperva full record

  1. [1]Thales completes acquisition imperva creating global leaderThales Group · thalesgroup.com · published December 4, 2023 · Tier A
  2. [2]AboutImperva · imperva.com · undated page, accessed September 27, 2026 · Tier A
  3. [3]Greg clark joins imperva board of directorsImperva · imperva.com · published June 4, 2014 · Tier A
  4. [4]Application securityImperva · imperva.com · published August 23, 2026 · Tier A
  5. [5]Cyber Security Leader | Imperva, Inc.Imperva · undated page, accessed October 25, 2026 · Tier A
  6. [6]Thales Launches Imperva for AWS to Help Organizations Protect Applications and APIsBusiness Wire · published August 3, 2026 · Tier A
  7. [7]Imperva Data Security Fabric Reviews & Product Details - G2G2 · undated page, accessed October 25, 2026 · Tier C
  8. [8]Thales Group (Imperva) Reviews - Gartner Peer InsightsGartner Peer Insights · undated page, accessed October 25, 2026 · Tier C
  9. [9]Best Application Security | Imperva WAAP ProtectionImperva · undated page, accessed November 6, 2026 · Tier A
  10. [10]Web Application Firewall (WAF) | Cloud & On-Prem | ImpervaImperva · undated page, accessed November 6, 2026 · Tier A
  11. [11]Advanced Bot Protection | Stop Advanced Bots | ImpervaImperva · undated page, accessed November 6, 2026 · Tier A
  12. [12]Advanced DDoS Protection & Mitigation Services | ImpervaImperva · undated page, accessed November 6, 2026 · Tier A
  13. [13]Client-Side Protection | PCI 4.0 Compliance | ImpervaImperva · undated page, accessed November 6, 2026 · Tier A
  14. [14]Enterprise AI & LLM Security | Stop Prompt Injection | ImpervaImperva · undated page, accessed November 6, 2026 · Tier A
  15. [15]Data Security Solutions | Protecting Data Everywhere | ImpervaImperva · undated page, accessed November 6, 2026 · Tier A
  16. [16]Plans and Services | Imperva Cyber SecurityImperva · undated page, accessed November 6, 2026 · Tier A
  17. [17]Retail & eCommerce Cyber Security | Secure Online Transactions | ImpervaImperva · undated page, accessed November 6, 2026 · Tier A
  18. [18]Data Security Fabric | Protect All Data Types | ImpervaImperva · undated page, accessed November 6, 2026 · Tier A
  19. [19]Bring Your Own CA: Introducing the Thales Imperva SSL Integration Center, Featuring DigiCert Trust Lifecycle ManagerImperva · published August 24, 2026 · Tier A

StackHawk full record

  1. [1]stackhawk.comStackHawk · stackhawk.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Stackhawk launches sensitive data identification to help security teams protect high risk apis 302476776StackHawk via PR Newswire · prnewswire.com · published June 12, 2025 · Tier A
  3. [3]AI Coding Agent Security Platform | StackHawk, Inc.StackHawk · undated page, accessed October 28, 2026 · Tier A
  4. [4]AI Coding Agent Security for Modern Security Teams | StackHawk, Inc.StackHawk · undated page, accessed October 28, 2026 · Tier A
  5. [5]API Security Testing Trusted by HealthTechStackHawk · undated page, accessed October 28, 2026 · Tier A
  6. [6]API Security that keeps pace with FinTech InnovationStackHawk · undated page, accessed October 28, 2026 · Tier A
  7. [7]Getting Started | Delivering Secure Applications, SimplifiedStackHawk · undated page, accessed October 28, 2026 · Tier A
  8. [8]OWASP Top 10 Solution Page with StackHawk InsightsStackHawk · undated page, accessed October 28, 2026 · Tier A
  9. [9]StackHawk: Your AppSec Intelligence PlatformStackHawk · undated page, accessed October 28, 2026 · Tier A
  10. [10]Secure Vibe Coding with StackHawkStackHawk · undated page, accessed October 28, 2026 · Tier A
  11. [11]Runtime Application Business Logic Testing for API-Driven AppsStackHawk · undated page, accessed October 28, 2026 · Tier A
  12. [12]StackHawk and Wiz: One Risk Picture Across the Application and Cloud LayerStackHawk · published April 30, 2026 · Tier A
  13. [13]StackHawk + Endor Labs: Correlating and Prioritizing SAST and DAST FindingsStackHawk · published November 20, 2025 · Tier A
  14. [14]Introducing Intelligent Business Logic Testing: Find Authorization Flaws Pre-ProductionStackHawk · published December 16, 2025 · Tier A
  15. [15]About StackHawk | Security Feedback for Coding AgentsStackHawk · undated page, accessed November 10, 2026 · Tier A
  16. [16]Pricing for StackHawk's AI Coding Agent Security PlatformStackHawk · undated page, accessed November 10, 2026 · Tier A
  17. [17]Modern DAST | StackHawk Dynamic Application Security TestingStackHawk · undated page, accessed November 10, 2026 · Tier A
  18. [18]The Developer-First Alternative to Bright SecurityStackHawk · undated page, accessed November 10, 2026 · Tier A

Spot a factual error? Request a correction.