Imperva

What Imperva protects

Imperva’s web application firewall examines application traffic for attacks such as SQL injection and cross-site scripting. Its product family includes cloud and on-premises deployment options. The public proxy signals described on this page concern its website-facing delivery layer; they are not an inventory of every Imperva product an organization uses.

For a business application, the firewall can provide a central place to apply request policies across services maintained by different teams. It adds a control point without requiring each application to implement the same filtering rules independently.

Managed rules and application behaviour

Imperva provides managed rules and tools for investigating security events. A rule evaluates a request at the security layer; the application still decides whether a user is authorized to view a record or perform an action. Those responsibilities complement each other.

For example, a permitted request to an account endpoint must still be checked against the signed-in user by the application. Passing a WAF inspection is not an authorization decision.

API Security and bot protection

Imperva API Security discovers and monitors APIs, including endpoints that may be absent from an organization’s inventory. It evaluates API risk and changes across environments. Advanced Bot Protection addresses unwanted automation across websites, mobile applications and APIs. These complement a WAF rather than reducing all API risks to a single request-filter rule.

The wider application and data security portfolio

Imperva also offers DDoS protection and data security capabilities. Application security concerns traffic reaching software, while data security concerns the sensitive information and data systems behind it. A website-facing Imperva proxy is evidence about that public request path; it does not reveal the organization’s internal database monitoring or data controls.

What to review during deployment

Exercise normal business workflows when introducing a firewall: sign-in, uploads, search and API integrations. Unusual but legitimate requests can require policy tuning. Record the affected URL, timestamp and request identifier so an operator can correlate a failure with the security logs.

Keep application updates and access controls in the maintenance plan. A proxy can block classes of unwanted requests, but it does not fix incorrect business logic or replace a tested recovery process.