Imperva

What Imperva does

Imperva is a US-headquartered cybersecurity vendor founded in 2002 and operating as a wholly-owned subsidiary of France-based Thales Group since December 2023, when Thales completed an approximately $3.6 billion acquisition. The company provides a cloud-native and hybrid security platform spanning application security (Web Application Firewall, Advanced Bot Protection, Unified API Security Platform, DDoS Protection, DNS Protection, Client-Side Protection, Account Takeover Protection, Runtime Application Self-Protection, Content Delivery Network, and AI Application Security) and data security (Data Security Fabric, Data Security Posture Management, plus discovery, classification, and risk analytics). Underlying technology includes proprietary language-theoretic attack detection in RASP, AI/ML-driven bot detection, and a globally distributed network of 50+ Points of Presence across North America, EMEA, LATAM, and APAC that enables edge-delivered inspection, mitigation, and content delivery.

The company monetizes primarily through subscription-based SaaS contracts for application and data security products, supplemented by professional services for implementation, training, and support, with quote-based tiered pricing tied to traffic volume, feature sets, and protected assets sold on annual or multi-year terms. Go-to-market is enterprise-led through direct field sales targeting financial services, government, healthcare, telecom, and retail verticals, layered with a global channel of regional distributors (Netpoleon, DataGroupIT, Maxtec, Platview) and technology integrations including a flagship native product for Google Cloud. Imperva serves 6,200+ enterprise customers, with notable deployments at BSE, Banco Popular Dominicano, Discovery Inc., Sabre, Quálitas, and Smallpdf, supported by 10,000+ employees across offices in the US, Canada, Mexico, Israel, the UK, the Netherlands, Sweden, the UAE, Australia, China, India, Japan, Singapore, and Taiwan. The firm maintains recognized analyst leadership positions including Overall Leader in KuppingerCole's 2024 and 2025 WAAP and 2025 API Security Leadership Compasses, and Leader in the Forrester Wave: WAF Solutions Q1 2025.

Name

Imperva

Legal name

Imperva Inc.

Website

https://imperva.com

Company type

Private

Founded year

2002

Operating status

Operating

Headcount range

5,001–10,000 employees

Short description

Imperva, a Thales subsidiary, provides application and data security solutions, including WAF, API security, bot protection, DDoS mitigation, RASP, and data security fabric, serving 6,200+ enterprise customers across financial services, government, healthcare, telecom, and retail globally.

Ownership category

akta.pro rank

Product category

Application and Data Security Software

NAICS

Security Systems Services (56162), Computer Systems Design and Related Services (54151), Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (5182)

SIC

Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Web Application Security (WAF, RASP) (HDADACAA)

akta.pro secondary industries

Attack Detection & Response for Cloud/SaaS (SOC for Cloud) (HDADAGAJ), Data Security & Privacy Managed Services (DLP/Encryption) (BPAEADAL)

Keywords

• Web application firewall
• Application security platform
• Data security fabric
• DDoS protection services
• API security platform

Headquarters

HQ city

Redwood Shores

HQ country

United States

HQ region

North America

Offices19 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Marketing or Sales, Infrastructure, Operations

Revenue model

1. Application Security Subscriptions: Cloud WAF, Advanced Bot Protection, API Security, and related application security products delivered as SaaS subscriptions with tiered pricing based on traffic volume and features.
2. Data Security Subscriptions: Data Security Fabric, Data Security Posture Management, and related data security products offered as recurring subscriptions.
3. DDoS Protection Services: Network and application DDoS protection services with volume-based or subscription pricing.
4. Professional Services: Implementation, training, and technical support services complementing product subscriptions.

Pricing tiers

Go-to-market motion3 records

Distribution channels5 records

Marketing channels9 records

Core offering

Imperva provides a comprehensive cybersecurity platform delivering application security and data security solutions. Its product portfolio includes Web Application Firewall (WAF), Advanced Bot Protection, API Security, DDoS Protection, DNS Protection, Client-Side Protection, Account Takeover Protection, Content Delivery Network, AI Application Security, Runtime Application Self-Protection (RASP), Data Security Fabric, and Data Security Posture Management, delivered primarily as cloud/SaaS subscriptions backed by a global network of 50+ Points of Presence.

Product overview

Imperva is a comprehensive cybersecurity platform providing application and data security solutions. The offering spans Application Security (including Web Application Firewall, Advanced Bot Protection, Unified API Security Platform, DDoS Protection, DNS Protection, Client-Side Protection, Account Takeover Protection, Content Delivery Network, and AI Application Security) and Data Security (Data Security Fabric, Data Security Posture Management, and supporting capabilities including Risk Analytics, Data Compliance, and Data Discovery). The platform unifies detection, investigation, and management under one architecture to consolidate security point products.

Differentiator

Problem solved

Functional benefit

Brands

• Imperva Application Security: Web Application Firewall (WAF), Advanced Bot Protection, API Security, DDoS Protection, and related application security solutions.
• Imperva Data Security
• Prevoty (Runtime Protection)
• Imperva for Google Cloud

Products and services

• Web Application Firewall (WAF)
• Advanced Bot Protection Identifies and mitigates sophisticated bad bots using AI and machine learning to analyze behavioral patterns and distinguish automated threats from legitimate users.
• Unified API Security Platform Discovers, detects, and mitigates API threats in a single console, providing comprehensive API security including discovery, runtime protection, API Detection and Response, and compliance monitoring.
• DDoS Protection Secures all assets at the edge with guaranteed uptime against distributed denial-of-service attacks including Layer 7 application-layer and network-layer DDoS attacks.
• DNS Protection Fast, secure DNS service safeguarding applications everywhere with protection against DNS-based attacks and ensuring reliable domain resolution.
• Client-Side Protection Provides visibility and control over third-party JavaScript code running on web pages, protecting against Magecart attacks and client-side supply chain threats.
• Account Takeover Protection Protects login endpoints and prevents account-based fraud through credential stuffing detection and behavioral analysis of login attempts.
• Content Delivery Network (CDN) Boosts website performance with caching and compression capabilities to accelerate content delivery and improve user experience.
• AI Application Security Secures AI applications for homegrown GenAI, protecting against prompt injection, data leakage, and model manipulation attacks targeting AI systems.
• Imperva for Google Cloud Best-in-class application security natively integrated into Google Cloud, protecting Google Cloud applications with integrated cloud-native security using Private Service Connect.
• Data Security Fabric Multicloud and hybrid security platform protecting all data types across on-premises and cloud environments with unified governance, security, and compliance.
• Data Security Posture Management Assesses data risk, fortifies data environment, and improves data governance through continuous security monitoring and compliance assessment.
• Runtime Application Self-Protection (RASP) Server-side security solution providing application security by default, automatically mitigating risks of exploits including zero-day vulnerabilities through language-theoretic attack detection without requiring rules or learning.

Quantifiable outcome

• Imperva prevented 10,000 attacks in first 4 hours of Black Friday weekend with no latency impact
• +1 more outcomes

Named customers7 records

Segments5 records

Ideal customer profiles5 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration4 records

AI capability12 records

Feature9 records

Partnerships

Seven partnerships are on record, tiered flagship, core and regional.

• Google CloudflagshipStrategic or Co-development Partner · 22 April 2026Imperva for Google Cloud brings enterprise-grade application security directly into Google Cloud using Service Extensions and Private Service Connect, enabling organizations to protect web applications and APIs while preserving existing pipelines and monitoring workflows.
• NetpoleoncoreChannel Partner/ Reseller/ Distributor · 25 November 2025Netpoleon expanded its cybersecurity portfolio across Australia and New Zealand by integrating Imperva's data and application security offerings alongside existing Thales CipherTrust partnership. Targets government, finance, and critical infrastructure sectors.
• CloudVectorcoreStrategic or Co-development Partner · 4 May 2021Imperva acquired CloudVector to enhance its API security and visibility solutions, broadening security coverage for traditional and micro-service APIs. The acquisition was expected to close in May 2021 pending regulatory approval.
• DataGroupITcoreChannel Partner/ Reseller/ DistributorDataGroupIT collaboration with Thales enhanced cybersecurity offerings in South Africa and across Africa. The partnership strengthened ability to protect data and pathways to it.
• MaxtecregionalChannel Partner/ Reseller/ DistributorMaxtec strengthened Imperva offering with full Thales cyber security stack, expanding reach in distribution channel.
• Platview TechnologiesregionalChannel Partner/ Reseller/ DistributorPlatview Technologies named platinum partner for Thales and Imperva.
• ThalesflagshipOthersImperva is a subsidiary of Thales Group, a France-based cybersecurity firm. Thales acquired Imperva in December 2023 for approximately $3.6 billion, strengthening its digital security portfolio.

Scale indicators4 records

Recent moves7 records

Expansion highlights6 records

Direct peers

• Cloudflare: Cloud-native WAF, DDoS protection, API security, and bot management delivered via a global edge network. Directly competes with Imperva across the full WAAP stack and targets the same enterprise CISO buyer.
• F5: Provides NGINX App Protect WAF, F5 Distributed Cloud WAAP, and API security. Competes head-to-head with Imperva's WAF and API security offerings for large enterprise and financial services workloads.
• Akamai Technologies: Akamai App & API Protector combines WAF, bot management, API security, and DDoS mitigation delivered through Akamai's global CDN. Direct competitor in WAAP with overlapping enterprise customer base.
• Radware: Specializes in DDoS protection, WAF, and bot management with both cloud and on-prem appliances. Direct peer in network/application protection, particularly for telecom and financial services customers.
• Barracuda Networks: Offers WAF-as-a-Service, bot mitigation, API protection, and DDoS protection targeted at mid-market and enterprise customers. Direct competitor particularly in the application security layer.
• Varonis: Provides data security posture management, data classification, and insider threat detection for cloud and on-prem data. Directly overlaps with Imperva Data Security Fabric for data-centric security buyers.

Broad incumbents

• Fortinet: FortiWeb WAF and FortiGuard bot protection are part of Fortinet's broader security fabric alongside firewall and SD-WAN. Competes with Imperva in WAF but bundles it into a much larger platform play.
• AWS (WAF & Shield): AWS WAF and AWS Shield provide native cloud WAF and DDoS protection for AWS workloads. Competes with Imperva primarily for cloud-native AWS deployments where Imperva must justify third-party cost over bundled hyperscaler services.

Emerging players

• Noname Security: Specializes in API posture management and runtime API threat detection. Competes with Imperva's API Security platform, particularly in API discovery and posture management use cases.
• DataTheorem: Cloud-native application and API security provider focused on mobile and web app protection. Competes with Imperva RASP and API security in modern cloud-native application stacks.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat6 records

Key risks5 records

Key highlights7 records

Customer concentration

• Xx.com/Imperva
• YouTubeyoutube.com/user/thethalesgroup
• Facebookfacebook.com/imperva
• LinkedInlinkedin.com/company/imperva
• Instagraminstagram.com/thalesgroup

Revenue estimate

Valuation estimate

Number of profiles

Profiles19 records

Subsidiaries1 record

Funding overview

Funding rounds8 records

Investors15 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A8 records

Investments1 record

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Imperva