Imperva
Imperva, a Thales subsidiary, provides application and data security solutions, including WAF, API security, bot protection, DDoS mitigation, RASP, and data security fabric, serving 6,200+ enterprise customers across financial services, government, healthcare, telecom, and retail globally.
- Company typePrivate
- Founded2002
- HeadquartersRedwood Shores, United States
- Headcount5,001–10,000
- GTM typeB2B
- OfferingSoftware
What Imperva does
Imperva is a US-headquartered cybersecurity vendor founded in 2002 and operating as a wholly-owned subsidiary of France-based Thales Group since December 2023, when Thales completed an approximately $3.6 billion acquisition. The company provides a cloud-native and hybrid security platform spanning application security (Web Application Firewall, Advanced Bot Protection, Unified API Security Platform, DDoS Protection, DNS Protection, Client-Side Protection, Account Takeover Protection, Runtime Application Self-Protection, Content Delivery Network, and AI Application Security) and data security (Data Security Fabric, Data Security Posture Management, plus discovery, classification, and risk analytics). Underlying technology includes proprietary language-theoretic attack detection in RASP, AI/ML-driven bot detection, and a globally distributed network of 50+ Points of Presence across North America, EMEA, LATAM, and APAC that enables edge-delivered inspection, mitigation, and content delivery.
The company monetizes primarily through subscription-based SaaS contracts for application and data security products, supplemented by professional services for implementation, training, and support, with quote-based tiered pricing tied to traffic volume, feature sets, and protected assets sold on annual or multi-year terms. Go-to-market is enterprise-led through direct field sales targeting financial services, government, healthcare, telecom, and retail verticals, layered with a global channel of regional distributors (Netpoleon, DataGroupIT, Maxtec, Platview) and technology integrations including a flagship native product for Google Cloud. Imperva serves 6,200+ enterprise customers, with notable deployments at BSE, Banco Popular Dominicano, Discovery Inc., Sabre, Quálitas, and Smallpdf, supported by 10,000+ employees across offices in the US, Canada, Mexico, Israel, the UK, the Netherlands, Sweden, the UAE, Australia, China, India, Japan, Singapore, and Taiwan. The firm maintains recognized analyst leadership positions including Overall Leader in KuppingerCole's 2024 and 2025 WAAP and 2025 API Security Leadership Compasses, and Leader in the Forrester Wave: WAF Solutions Q1 2025.
Imperva firmographics
Firmographics- Name
- Imperva
- Legal name
- Imperva Inc.
- Website
- https://imperva.com
- Company type
- Private
- Founded year
- 2002
- Operating status
- Operating
- Headcount range
- 5,001–10,000 employees
- Short description
- Imperva, a Thales subsidiary, provides application and data security solutions, including WAF, API security, bot protection, DDoS mitigation, RASP, and data security fabric, serving 6,200+ enterprise customers across financial services, government, healthcare, telecom, and retail globally.
- Ownership category
- akta.pro rank
Imperva industry classification
Industry- Product category
- Application and Data Security Software
- NAICS
- Security Systems Services (56162), Computer Systems Design and Related Services (54151), Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (5182)
- SIC
- Services-Computer Programming, Data Processing, Etc. (7370)
- akta.pro primary industry
- Web Application Security (WAF, RASP) (HDADACAA)
- akta.pro secondary industries
- Attack Detection & Response for Cloud/SaaS (SOC for Cloud) (HDADAGAJ), Data Security & Privacy Managed Services (DLP/Encryption) (BPAEADAL)
Keywords
Where Imperva is headquartered
LocationHeadquarters
- HQ city
- Redwood Shores
- HQ country
- United States
- HQ region
- North America
Offices19 records
Markets served
Imperva business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Technology or R&D, Personnel, Marketing or Sales, Infrastructure, Operations
Revenue model
- Application Security Subscriptions: Cloud WAF, Advanced Bot Protection, API Security, and related application security products delivered as SaaS subscriptions with tiered pricing based on traffic volume and features.
- Data Security Subscriptions: Data Security Fabric, Data Security Posture Management, and related data security products offered as recurring subscriptions.
- DDoS Protection Services: Network and application DDoS protection services with volume-based or subscription pricing.
- Professional Services: Implementation, training, and technical support services complementing product subscriptions.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | Enterprise subscription tiers with increasing capabilities |
Go-to-market motion3 records
Distribution channels5 records
Marketing channels9 records
Imperva product offering
Product offeringCore offering
Imperva provides a comprehensive cybersecurity platform delivering application security and data security solutions. Its product portfolio includes Web Application Firewall (WAF), Advanced Bot Protection, API Security, DDoS Protection, DNS Protection, Client-Side Protection, Account Takeover Protection, Content Delivery Network, AI Application Security, Runtime Application Self-Protection (RASP), Data Security Fabric, and Data Security Posture Management, delivered primarily as cloud/SaaS subscriptions backed by a global network of 50+ Points of Presence.
Product overview
Imperva is a comprehensive cybersecurity platform providing application and data security solutions. The offering spans Application Security (including Web Application Firewall, Advanced Bot Protection, Unified API Security Platform, DDoS Protection, DNS Protection, Client-Side Protection, Account Takeover Protection, Content Delivery Network, and AI Application Security) and Data Security (Data Security Fabric, Data Security Posture Management, and supporting capabilities including Risk Analytics, Data Compliance, and Data Discovery). The platform unifies detection, investigation, and management under one architecture to consolidate security point products.
Differentiator
Problem solved
Functional benefit
Brands
- Imperva Application Security: Web Application Firewall (WAF), Advanced Bot Protection, API Security, DDoS Protection, and related application security solutions.
- Imperva Data Security
- Prevoty (Runtime Protection)
- Imperva for Google Cloud
Products and services
- Web Application Firewall (WAF)
- Advanced Bot Protection Identifies and mitigates sophisticated bad bots using AI and machine learning to analyze behavioral patterns and distinguish automated threats from legitimate users.
- Unified API Security Platform Discovers, detects, and mitigates API threats in a single console, providing comprehensive API security including discovery, runtime protection, API Detection and Response, and compliance monitoring.
- DDoS Protection Secures all assets at the edge with guaranteed uptime against distributed denial-of-service attacks including Layer 7 application-layer and network-layer DDoS attacks.
- DNS Protection Fast, secure DNS service safeguarding applications everywhere with protection against DNS-based attacks and ensuring reliable domain resolution.
- Client-Side Protection Provides visibility and control over third-party JavaScript code running on web pages, protecting against Magecart attacks and client-side supply chain threats.
- Account Takeover Protection Protects login endpoints and prevents account-based fraud through credential stuffing detection and behavioral analysis of login attempts.
- Content Delivery Network (CDN) Boosts website performance with caching and compression capabilities to accelerate content delivery and improve user experience.
- AI Application Security Secures AI applications for homegrown GenAI, protecting against prompt injection, data leakage, and model manipulation attacks targeting AI systems.
- Imperva for Google Cloud Best-in-class application security natively integrated into Google Cloud, protecting Google Cloud applications with integrated cloud-native security using Private Service Connect.
- Data Security Fabric Multicloud and hybrid security platform protecting all data types across on-premises and cloud environments with unified governance, security, and compliance.
- Data Security Posture Management Assesses data risk, fortifies data environment, and improves data governance through continuous security monitoring and compliance assessment.
- Runtime Application Self-Protection (RASP) Server-side security solution providing application security by default, automatically mitigating risks of exploits including zero-day vulnerabilities through language-theoretic attack detection without requiring rules or learning.
Quantifiable outcome
- Imperva prevented 10,000 attacks in first 4 hours of Black Friday weekend with no latency impact
- +1 more outcomes
Companies that use Imperva
Customer profileNamed customers7 records
Segments5 records
Ideal customer profiles5 records
Imperva technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration4 records
AI capability12 records
Feature9 records
Imperva partnerships and signals
Strategic signalPartnerships
Seven partnerships are on record, tiered flagship, core and regional.
- Google CloudflagshipImperva for Google Cloud brings enterprise-grade application security directly into Google Cloud using Service Extensions and Private Service Connect, enabling organizations to protect web applications and APIs while preserving existing pipelines and monitoring workflows.
- NetpoleoncoreNetpoleon expanded its cybersecurity portfolio across Australia and New Zealand by integrating Imperva's data and application security offerings alongside existing Thales CipherTrust partnership. Targets government, finance, and critical infrastructure sectors.
- CloudVectorcoreImperva acquired CloudVector to enhance its API security and visibility solutions, broadening security coverage for traditional and micro-service APIs. The acquisition was expected to close in May 2021 pending regulatory approval.
- DataGroupITcoreDataGroupIT collaboration with Thales enhanced cybersecurity offerings in South Africa and across Africa. The partnership strengthened ability to protect data and pathways to it.
- MaxtecregionalMaxtec strengthened Imperva offering with full Thales cyber security stack, expanding reach in distribution channel.
- Platview TechnologiesregionalPlatview Technologies named platinum partner for Thales and Imperva.
- ThalesflagshipImperva is a subsidiary of Thales Group, a France-based cybersecurity firm. Thales acquired Imperva in December 2023 for approximately $3.6 billion, strengthening its digital security portfolio.
Scale indicators4 records
Recent moves7 records
Expansion highlights6 records
Imperva competitors and assessment
Company assessmentDirect peers
- Cloudflare: Cloud-native WAF, DDoS protection, API security, and bot management delivered via a global edge network. Directly competes with Imperva across the full WAAP stack and targets the same enterprise CISO buyer.
- F5: Provides NGINX App Protect WAF, F5 Distributed Cloud WAAP, and API security. Competes head-to-head with Imperva's WAF and API security offerings for large enterprise and financial services workloads.
- Akamai Technologies: Akamai App & API Protector combines WAF, bot management, API security, and DDoS mitigation delivered through Akamai's global CDN. Direct competitor in WAAP with overlapping enterprise customer base.
- Radware: Specializes in DDoS protection, WAF, and bot management with both cloud and on-prem appliances. Direct peer in network/application protection, particularly for telecom and financial services customers.
- Barracuda Networks: Offers WAF-as-a-Service, bot mitigation, API protection, and DDoS protection targeted at mid-market and enterprise customers. Direct competitor particularly in the application security layer.
- Varonis: Provides data security posture management, data classification, and insider threat detection for cloud and on-prem data. Directly overlaps with Imperva Data Security Fabric for data-centric security buyers.
Broad incumbents
- Fortinet: FortiWeb WAF and FortiGuard bot protection are part of Fortinet's broader security fabric alongside firewall and SD-WAN. Competes with Imperva in WAF but bundles it into a much larger platform play.
- AWS (WAF & Shield): AWS WAF and AWS Shield provide native cloud WAF and DDoS protection for AWS workloads. Competes with Imperva primarily for cloud-native AWS deployments where Imperva must justify third-party cost over bundled hyperscaler services.
Emerging players
- Noname Security: Specializes in API posture management and runtime API threat detection. Competes with Imperva's API Security platform, particularly in API discovery and posture management use cases.
- DataTheorem: Cloud-native application and API security provider focused on mobile and web app protection. Competes with Imperva RASP and API security in modern cloud-native application stacks.
Market position
Strengths4 records
Weaknesses4 records
Competitive moat6 records
Key risks5 records
Key highlights7 records
Customer concentration
Imperva social profiles
Digital presenceImperva financial estimates
Financial estimateRevenue estimate
Valuation estimate
Imperva leadership team
Management profileNumber of profiles
Profiles19 records
Imperva subsidiaries and ownership
Company hierarchySubsidiaries1 record
Imperva funding detail
Funding detailFunding overview
Funding rounds8 records
Investors15 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Imperva M&A and investment
M&A and investmentM&A8 records
Investments1 record
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Imperva
What does Imperva do?
Imperva provides a comprehensive cybersecurity platform delivering application security and data security solutions. Its product portfolio includes Web Application Firewall (WAF), Advanced Bot Protection, API Security, DDoS Protection, DNS Protection, Client-Side Protection, Account Takeover Protection, Content Delivery Network, AI Application Security, Runtime Application Self-Protection (RASP), Data Security Fabric, and Data Security Posture Management, delivered primarily as cloud/SaaS subscriptions backed by a global network of 50+ Points of Presence.
Is Imperva a public or private company?
Imperva is a private company. It is classified as corporate owned and is currently operating.
When was Imperva founded?
Imperva was founded in 2002. It employs 5,001 to 10,000 people.
Where is Imperva based?
Imperva is headquartered in Redwood Shores, United States, in the North America region.
How does Imperva make money?
Four revenue lines are on record. Application Security Subscriptions are the primary driver. The others are data Security Subscriptions, DDoS Protection Services and professional Services.
Who are Imperva's main competitors?
Direct peers on record are Cloudflare, F5, Akamai Technologies, Radware, Barracuda Networks and Varonis. Broad incumbents are Fortinet and AWS (WAF & Shield). Emerging players are Noname Security and DataTheorem.
Does Imperva have an API?
Yes. Imperva provides a documented API for Cloud WAF and other security products. The API enables developers to automate tasks including site management, security policy configuration (alert, block, etc.), application delivery rules for global load balancing, URL manipulation, and header enrichment for downstream origin servers. Imperva also offers a HashiCorp Terraform provider for infrastructure-as-code deployment and management of Imperva Cloud WAF configurations. Developer documentation is at docs-cybersec.thalesgroup.com/bundle/api-docs.
What industry is Imperva in?
Imperva's product category is Application and Data Security Software. Its primary akta.pro industry code is HDADACAA, Web Application Security (WAF, RASP), with a secondary code of HDADAGAJ, Attack Detection & Response for Cloud/SaaS (SOC for Cloud). Its NAICS code is 56162 and its SIC code is 7370.