Smart WAF vs Imperva
An honest, side-by-side capability map — what Smart WAF does, what Imperva does as an enterprise incumbent, and where we plainly do not compete.
Comparison pages usually flatter whoever wrote them. This one is built the other way. Imperva is a large enterprise incumbent, and the table below says so plainly: every row on the Smart WAF side traces to code running at our edge today; every Imperva cell is a publicly-true fact, including the rows where a hyperscale enterprise vendor clearly leads. We are a focused, EU-based managed WAF — not a global enterprise platform — and the table says exactly where that helps and where it does not.
Where we don't compete, we say so plainly. This table is not curated to flatter us.
| Smart WAF | Imperva | |
|---|---|---|
| WAF engine & OWASP CRS rules | YesDual signature WAF engines — one in an in-process WASM sandbox, one native — run the OWASP ruleset against every request, selectable per route. | YesEnterprise cloud WAF with its own managed signature set and a managed OWASP Core Rule Set option. |
| Graduated challenge ladder | YesSuspicious clients escalate through proof-of-work, then CAPTCHA, then Web Bot Auth (cryptographic HTTP message signatures) — never an all-or-nothing block. | YesAdvanced Bot Protection applies its own progressive challenge and mitigation mechanisms. |
| ML entity-scoring with detection → verify → enforce graduation | YesPer-entity risk scoring proves itself through detection, then verify, before it is ever allowed to enforce. | PartialShips ML-based bot and threat scoring, but not this explicit detection → verify → enforce graduation model. |
| L3/L4 edge early-drop | YesConfirmed-malice traffic is dropped in the kernel via nftables/netdev before it reaches the WAF. | YesOperates large-scale network-layer (L3/L4) DDoS mitigation. |
| Per-tenant Let's Encrypt certificates | YesPer-tenant automatic TLS issues and renews a dedicated Let's Encrypt certificate for each tenant domain. | YesIssues and manages TLS certificates for protected domains. |
| EU data residency, GDPR-native, no cookies or trackers | YesEdge nodes run in the EU (Hetzner, OVH, Scaleway); residency, retention and deletion are architectural defaults, and this site sets no cookies or trackers. | PartialUS-headquartered; EU and regional data-localisation are available as configuration rather than the default. |
| Full immutable audit trail | YesEvery write lands in an append-only audit log surfaced in the tenant portal. | YesProvides audit and activity logging across its management console. |
| Global CDN / Anycast PoP network | NoWe are not a CDN. We do not run a worldwide fleet of edge points of presence or a content cache — if global static delivery is your primary need, a CDN is the right tool and we are not it. | YesRuns a global content-delivery and points-of-presence network. |
| Enterprise security breadth: RASP, API & database security | NoWe are a focused edge WAF. We do not ship runtime application self-protection, a database security product, or a full API-security suite — if you need that breadth under one vendor, an enterprise platform is the honest fit. | YesOffers a broad enterprise portfolio spanning application, API and data security. |
| Held third-party compliance certifications | NoWe hold no third-party compliance certifications yet, and our claims audit states plainly what we do and do not hold. | YesHolds a broad portfolio of independently audited compliance certifications. |
| Production-scale fleet & published throughput benchmarks | PartialWe run a single staging node today; any latency figure is labelled staging-measured against a ≤5 ms design budget, never presented as a production-fleet result. | YesOperates a global production fleet with published performance figures. |
See it running on your own domain
We onboard early partners by hand. Tell us your domain and we take it from there.