What Imperva Incapsula does

Imperva Incapsula is a cloud-based application and data security platform serving 6,200+ enterprise customers globally, operating as a wholly-owned subsidiary of Thales Group since its 2018 acquisition. The company delivers a unified security portfolio organized around two pillars: Application Security (Web Application Firewall, Advanced Bot Protection, Unified API Security, DDoS Protection, DNS Protection, Client-Side Protection, Account Takeover Protection, Content Delivery Network, AI Application Security, and Runtime Application Self-Protection via the Prevoty acquisition) and Data Security (Data Security Fabric, Data Security Posture Management, data discovery and classification, risk analytics, and compliance management). Underpinning the platform is a global edge infrastructure of 61+ Points of Presence across North America, EMEA, APAC, and LATAM, and a proprietary Language Theoretic approach within its RASP module that detects attacks without signatures, rules, or learning phases.

The company monetizes primarily through annual subscription contracts with tiered, quote-based enterprise pricing, supplemented by professional services for implementation and a 30-day free trial self-serve motion targeting mid-market prospects. Distribution combines direct enterprise field sales with the Imperva Accelerate channel partner program and a Technology Alliance Partners ecosystem including Google Cloud and Cloudera. Customer concentration is spread across government (BSE), financial services (Banco Popular Dominicano, Monex, Quálitas, Hi Bank Indonesia), retail, travel (Sabre), media (Discovery Inc.), and technology verticals, with primary use cases centered on PCI DSS 4.0 compliance, OWASP Top 10 mitigation, bot and fraud prevention, multi-cloud data protection, and emerging AI/GenAI application security.

Imperva's strategic positioning is reinforced by 2024-2025 analyst leadership recognitions including KuppingerCole Leadership Compass Leader in WAAP, API Security, and Data Security Platforms, Forrester Wave Leader for WAF Q1 2025, and a perfect vulnerability assessment score in SecureIQLab's cloud WAAP validation. Recent product expansion into AI Application Security, DNS Protection, native Google Cloud integration, CDN, and DSPM indicates active category creation across GenAI protection and cloud-native security postures.

Name

Imperva Incapsula

Legal name

Imperva, Inc.

Website

https://imperva.com

Company type

Private

Founded year

2002

Operating status

Operating

Headcount range

1,001–5,000 employees

Short description

Imperva Incapsula is a Thales-owned cloud application and data security platform protecting 6,200+ enterprises globally with WAF, bot/API/DDoS protection, RASP, and Data Security Fabric delivered through 61+ PoPs and a unified security console.

Ownership category

akta.pro rank

Product category

Application Security Software

NAICS

Software Publishers (5132), Software Publishers (513210)

SIC

Services-Prepackaged Software (7372), Services-Computer Integrated Systems Design (7373)

akta.pro primary industry

Attack Detection & Response for Cloud/SaaS (SOC for Cloud) (HDADAGAJ)

akta.pro secondary industries

Hybrid Cloud Security, Identity & Policy Enforcement (HDABAMAC), Cloud Security Managed Services (CSPM/CWPP/CNAPP) (BPAEADAF)

Keywords

• Web application firewall
• DDoS protection services
• API security platform
• Bot management solutions
• Data security fabric

Headquarters

HQ city

Redwood Shores

HQ country

United States

HQ region

North America

Offices5 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Infrastructure, Marketing or Sales, Operations

Revenue model

1. Subscription Security Services: Recurring subscription-based model for cloud security services including WAF, DDoS protection, bot management, and API security. Typically billed annually with tiered pricing based on usage and features.
2. Data Security Platform: Enterprise data security platform subscriptions providing data discovery, classification, compliance, and risk analytics capabilities across on-premises and cloud environments.
3. Professional Services: Implementation, training, and technical support services for enterprise deployments.

Pricing tiers

Go-to-market motion2 records

Distribution channels4 records

Marketing channels9 records

Core offering

Imperva sells a unified cloud-based cybersecurity platform that protects enterprise web applications, APIs, and sensitive data. Its Application Security suite combines a Web Application Firewall, DDoS protection, advanced bot mitigation, API security, client-side protection, account takeover defense, and RASP, while its Data Security suite delivers a Data Security Fabric with discovery, classification, and compliance capabilities. All offerings are managed through a single Cloud Security Console and sold as recurring subscriptions to enterprise customers.

Product overview

Imperva offers a comprehensive cybersecurity platform organized into two main pillars: Application Security and Data Security. The Application Security portfolio includes the Web Application Firewall (WAF) as the core product, complemented by Advanced Bot Protection, Unified API Security Platform, DDoS Protection, DNS Protection, Client-Side Protection, Account Takeover Protection, Content Delivery Network (CDN), AI Application Security, and Runtime Application Self-Protection (RASP). The Data Security portfolio centers on the Data Security Fabric platform with Data Security Posture Management, Data Discovery & Classification, Risk Analytics & Insights, and Data Compliance at Scale as key capabilities. The platform also includes Imperva for Google Cloud as a cloud-native integration. All products are managed through a unified Cloud Security Console, providing consolidated security point products for detection, investigation, and management under one platform architecture.

Differentiator

Problem solved

Functional benefit

Brands

• Imperva RASP: Runtime Application Self-Protection technology for server-side application security
• Cloud WAF
• WAF Gateway

Products and services

• Application Security Platform

Quantifiable outcome

• Prevented 10,000 attacks in first 4 hours of Black Friday weekend with no latency impact
• +1 more outcomes

Named customers10 records

Segments6 records

Ideal customer profiles6 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration1 record

AI capability3 records

Feature13 records

Partnerships

Five partnerships are on record, tiered core and major.

• Thales GroupcoreOthersImperva is a subsidiary of Thales Group, a global leader in cybersecurity and data protection. Thales acquired Imperva to strengthen its cybersecurity portfolio. Imperva operates as the cybersecurity division within Thales, contributing to the company's digital identity and security business line.
• Google CloudmajorTechnology or IntegrationImperva for Google Cloud provides best-in-class application security natively integrated into Google Cloud. This integration offers enterprises deploying on Google Cloud access to Imperva's comprehensive WAF, DDoS protection, and API security capabilities as a native cloud service.
• ClouderacoreTechnology or IntegrationTechnology partnership providing data security integration for Cloudera environments. Imperva helps protect Cloudera data with comprehensive security, monitoring, and compliance capabilities for enterprise data platforms.
• Channel Partners (Resellers and Distributors)coreChannel Partner/ Reseller/ DistributorExtensive global network of channel partners reselling and distributing Imperva security solutions. The Imperva Accelerate partner program provides training, enablement, and support for channel partners to deliver Imperva solutions to end customers.
• Technology Alliance Partners (TAP)coreTechnology or IntegrationImperva collaborates with top technology companies through its Technology Alliance Partners program for product integrations and ecosystem development. Partners benefit from joint go-to-market opportunities and technical integration support.

Scale indicators4 records

Recent moves6 records

Expansion highlights6 records

Emerging players

• HUMAN Security: HUMAN (formerly White Ops) competes with Imperva's bot protection and ATO offerings, focusing on sophisticated bot and fraud defense for e-commerce, advertising, and enterprise applications.
• DataDome: DataDome is a pure-play bot mitigation and account takeover protection vendor that directly overlaps with Imperva's Advanced Bot Protection and ATO modules, often positioned as a best-of-breed alternative.

Direct peers

• Cloudflare: Cloudflare is the most direct competitor to Imperva, offering WAF, DDoS protection, bot management, API security, DNS, and CDN on a single global anycast network. Both target the same enterprise web application security buyer with comparable feature breadth and a subscription model.
• Akamai (App & API Protector): Akamai's App & API Protector combines WAF, bot mitigation, DDoS, and API security delivered via Akamai's CDN edge, directly overlapping Imperva's application security portfolio for large enterprise and media customers.
• Fastly (Signal Sciences + Next-Gen WAF): Fastly's Signal Sciences–powered Next-Gen WAF, bot mitigation, and API protection compete head-to-head with Imperva's WAF, RASP-style runtime insights, and bot modules, particularly with developer-focused enterprise customers.
• Barracuda Networks: Barracuda's WAF-as-a-Service, bot mitigation, and application security products compete with Imperva's Cloud WAF in the mid-market and enterprise segments, especially through channel partners.
• F5 (Distributed Cloud / NGINX App Protect / AWAF): F5 competes with Imperva in WAF (AWAF), bot defense, and API security, particularly for large enterprises that already run F5 BIG-IP infrastructure. F5 Distributed Cloud extends WAF and bot mitigation to multi-cloud, directly comparable to Imperva's Cloud WAF.
• Radware: Radware provides DDoS protection, WAF, bot management, and API security—overlapping directly with Imperva's application security portfolio for carriers, financial services, and large enterprises.
• Fortinet (FortiWeb): FortiWeb competes directly with Imperva's WAF, particularly for enterprises already standardized on Fortinet's firewall and security fabric, offering WAF plus bot defense in a single appliance or VM.

Broad incumbents

• AWS WAF + Shield: AWS WAF and Shield are hyperscaler-native WAF and DDoS services bundled with broader AWS cloud spend. They compete with Imperva's Cloud WAF for AWS-hosted workloads and frequently displace standalone WAAP vendors at renewal.

Market position

Strengths4 records

Weaknesses5 records

Competitive moat6 records

Key risks6 records

Key highlights6 records

Customer concentration

• Xx.com/imperva
• YouTubeyoutube.com/user/thethalesgroup
• Facebookfacebook.com/thalesgroup
• LinkedInlinkedin.com/company/imperva

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Subsidiaries1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Imperva Incapsula