My company is working with Citrix Web App and API Protection, but the team doesn't like the solution. The team used version 11 of Citrix Web App and API Protection. Version 12 of the solution stopped working on the exchange server because of authentication issues. It serves as a proxy, but you can do it with Apache or Nginx if you want. There's nothing special with the solution in terms of protection and no notification if there's an issue, so Citrix Web App and API Protection does not have much use. About ten people use Citrix Web App and API Protection in my company. My advice to people who want to implement the solution is "Better not start". My rating for Citrix Web App and API Protection, if you have the solution, would be in the middle. There's no practical use for it for technical system administrators. I'm rating it six out of ten. I don't know the exact relationship with Citrix, but it seems my company has the license for partners in terms of usage.