F5 expanded its application security portfolio with a software-as-a-service (SaaS) platform providing security, multicloud networking, and edge computing services. The vendor also rolled out the platform's first new service: F5 Distributed Cloud web application and API protection (WAAP).

As organizations distribute applications across data centers, multiple public clouds, and edge locations, this creates a larger attack surface. “Legacy old castle-moat security architectures are no longer adequate,” ESG Principal Analyst Bob Laliberte wrote in response to questions, adding that those applications rely on APIs to communicate and also need to be protected against bot attacks.

To better address those challenges, F5 built the Distributed Cloud platform integrating with its web application firewall (WAF), distributed denial-of-service (DDoS), API and bot protection capabilities —  mostly using technology from its recent acquisitions, F5 VP of product marketing Mark Weiner said. 

He calls the F5 platform “a great Swiss Army knife,” which adds blades through acquisitions. The vendor acquired cloud security and workload protection company Threat Stack last September, closed its Volterra acquisition in 2021, bought DevOps company NGINX in a $670 million deal in early 2019, and later that year paid $1billion to buy Shape Security.

Volterra brought platform and management console, multicloud networking, API security, and DDoS capabilities to the new platform, while Shape enabled bot and fraud defense. Meanwhile the WAF capabilities came from Volterra and F5 homegrown services. The vendor renamed those capabilities to be under the theme of “F5 Distributed Cloud,” such as F5 Distributed Cloud Bot Defense.

“​​The rebranding simplifies their offerings,” Securosis analyst and President Mike Rothman said. “Having all of those brands makes it complicated for the F5 field to sell and their channel partners to position to their customers. And having a common naming scheme lends itself to integration and upsell opportunities.”

F5’s Distributed Cloud platform rollout kicked off with a new service: WAAP, which bundles its WAF, API security, and bot defense services. 

The WAAP market is the evolution of the WAF. It started with cloud-delivered WAF services, and then some vendors began bundling WAFs with application-layer DDoS protection before eventually adding more advanced bot management and API protection, Jeremy D’Hoinne, research VP at Gartner told SDxCentral in an earlier interview. These four capabilities now define WAAP, which is usually delivered as a cloud service.

Gartner named F5 as one of the challengers in last year’s WAAP Magic Quadrant, and analysts commented favorably on its move to acquire Volterra and Shape.

“F5 has been one of the market leaders in the WAF space and has been adding to those capabilities organically, focusing on cloud-delivery, and building through acquisition,” Laliberte said, adding that continued development of its AI analytics capabilities from Shape will be critical to the broader WAAP platform.

As “just about every WAF provider has or is migrating towards WAAP,” F5 faces fierce competition in this fast-growing space from traditional WAF and application delivery controller vendors such as Imperva and Citrix, and content distribution network providers including Akamai, Fastly, and Cloudflare, Laliberte said.

Besides Akamai and Cloudflare, large cloud providers such as Amazon and Google also led the WAAP market, added Chris Rodriguez, research director for network security products and strategies at IDC. “For F5, this scalable, flexible SaaS offering provides the company with a complete set of deployment options to help its customers secure their applications across every environment.”

He said he expects F5 to fill “a vital missing piece of the puzzle” in its WAAP capabilities — the ability to offer scalable cloud services — with its new service.  

Weiner also touted F5’s WAAP service as “100% SaaS based,” adding that customers are “getting top-tier efficacy with the benefit of the speed of SaaS, with a single management screen for all of it.”  

F5 Distributed Cloud WAAP is globally available from vendor and will launch in the Microsoft Azure Marketplace by the end of February.