Wallarm NG WAF Review
Deployment is simple. Machine learning techniques lower the false-positives alerts rate.


What is most valuable?

Deployment simplicity helps our maintenance guys to set up quickly.
Their machine learning techniques significantly lower the false-positive alerts rate.

How has it helped my organization?

The use of a WAF becomes especially relevant in the case of concrete vulnerabilities, such as those uncovered via penetration tests or source code reviews. Even if it were possible to fix the vulnerability in the application promptly and with a reasonable amount of effort, the modified version can generally only be deployed at the next maintenance interval; often 2-4 weeks later (a patch dilemma).

For a WAF with whitelisting, vulnerabilities can be fixed promptly (hotfix) so that they cannot be exploited before the next scheduled maintenance. WAFs are especially fast in this aspect, meaning they can collaborate with source code analysis tools, so that detected external vulnerabilities can automatically result in a recommended rule set for the WAF.

A WAF is particularly important in securing productive web applications which themselves in turn consist of multiple components and which cannot be quickly changed by the operator; e.g., in the case of poorly documented applications or regarding third-party products without sufficient maintenance cycles.

A WAF is the only option for promptly closing external vulnerabilities.

What needs improvement?

It is only about stability issues. But it is a usual problem for all new products. At this moment, we have no incidents with Wallarm that has been up for eight months.

For how long have I used the solution?

I have used Willarm for one year.

What do I think about the stability of the solution?

There were several stability issues during the first pilot. At this moment, we have had no incidents with Wallarm that has been up for eight months.

What do I think about the scalability of the solution?

The product is nicely scalable.

How is customer service and technical support?

Technical support is great; guys respond in minutes.

Which solutions did we use previously?

Wallarm was our first WAF solution.

How was the initial setup?

Deployment was very simple and non-abusive.

What's my experience with pricing, setup cost, and licensing?

Wallarm is an expensive solution, but they are worth the money.

Which other solutions did I evaluate?

We have tested and evaluated several WAF solutions, and chose Wallarm. They are the only solution that fits our success criteria and business objectives:

  • WAF must have a low (<5%) false negative rate and be ready to protect from all well-known web attacks.
  • WAF must have a low (<0.05%) false positive rate.
  • WAF must not have any performance issues that impact projects under its protection.
  • Deployment takes < 1d for any web project.
  • WAF must have an ability to scale well horizontally and not to be a bottleneck to our services.
  • Keep monetization level at the same level, after all protection mechanisms enabled.
Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.

Add a Comment

Guest
Why do you like it?

Sign Up with Email