Gartner crowned Akamai Technologies, Cloudflare, and Imperva as “leaders” of the cloud web application and API protection (WAAP) market in its latest Magic Quadrant report.

Gartner evaluated 11 cloud WAAP vendors. Amazon Web Services (AWS) and Fastly made it into the “challengers” quadrant; Radware was the only vendor in the “visionaries” square; and Gartner labeled Microsoft, F5, Fortinet, Barracuda, and ThreatX “niche players.”

According to the report, cloud WAAPs are cloud-delivered services that mainly protect public-facing web applications and APIs by mitigating a broad range of runtime attacks, web application threats, automated, and specialized attacks on APIs. Its core capabilities include web application firewall (WAF), distributed denial-of-service (DDoS) protection, bot management, and API protection.

Gartner expects 70% of organizations that implement multi-cloud strategies for web applications will prefer cloud WAAP services compared to WAAP appliances and infrastructure-as-a-service (IaaS) native WAAP by 2024. And by 2026, 40% of companies will select a WAAP provider based on the advanced API protections they offer as well as web application security features, compared to 15% this year, Gartner says.

“The overall cloud WAAP market is mature, though some segments are quite dynamic, such as bot management and API threat protection,” the report noted. “Unlike the WAAP appliance market, which is dominated by replacement purchases, the cloud WAAP market continues to experience double-digit growth, thanks to new customers, new applications to protect, and shifts from appliances to cloud-delivered security.”

Akamai Offers a Broad and Diverse Portfolio

Akamai last November merged its two WAAP products: Kona Site Defender (KSD) and Web Application Protector (WAP), which is a lower-priced, limited-feature version of KSD, into a new product — App & API Protector. The vendor more recently released an updated version of its Adaptive Security Engine for WAAP.

Gartner noted Akamai's integration of web application and security features appeals to large organizations seeking a comprehensive solution. However, the firm cautioned about customer confusion about this portfolio transition, and false positive issues, especially for bot detection.

Cloudflare, Imperva Graded

Cloudflare’s cloud-delivered WAAP portfolio includes DDoS protection and mitigation, WAF, bot management, API gateway, and page shield. Gartner noted the vendor continues to expand beyond application protection, adding API discovery, scheme ingestion, and semiautomated rate limiting, but added that Cloudflare’s offering lacks hybrid deployment and needs improvement for some forensic analysis capabilities. 

Imperva’s cloud WAAP service — Cloud WAF — is under its “Imperva Anywhere” portfolio, which also includes adjacent application approaches such as runtime application self-protection (RASP) and database security.

Gartner noted this strategy “resonates with security teams willing to centrally manage WAAP enforcement points in different form factors.” The vendor also touted its WAAP service enables customers to deploy from appliances in data centers, software-as-a-service (SaaS), to part of cloud-native applications and workflows in major public clouds.  

However, Imperva has seen some recent leadership changes that Gartner said have had an adverse impact on the vendor's roadmap execution and overall market presence over the past year.