WAF vendors
We list 23 companies active in WAF and bot protection, and 8 of them have it as their main focus. 6 are public, 4 are owned by another company and 13 are private. Most are based in the United States (18). The oldest, Microsoft, was founded in 1975. By revenue from annual reports, the largest company here is Microsoft ($331.8bn in FY2026).
By countryUnited States 18
Companies focused on WAF and bot protection
8 companies| Company | Based in | Founded | Size | Ownership | Revenue |
|---|---|---|---|---|---|
F5 F5 provides application delivery and security solutions for hybrid multicloud environments. | Seattle, United States | 1996 | Public, FFIV | $3.1bn (FY2025) | |
Fastly Fastly provides an edge cloud platform that helps businesses deliver, secure, and deploy applications and AI workloads. | San Francisco, United States | 2011 | Public, FSLY | $624.0m (FY2025) | |
Cloudbric Cloudbric provides cloud-based security services including web application firewalls and VPNs. | Seoul, South Korea | 2015 | Private | ||
Imperva Imperva is a cybersecurity company that provides application security and data security. | San Mateo, United States | 2002 | Owned by Thales | ||
Sucuri Sucuri provides cloud-based website security. | Menifee, United States | 2010 | Owned by GoDaddy | ||
Transparent Edge Transparent Edge is a European content delivery network and edge computing platform that also provides web and application security. | Madrid, Spain | 2008 | Private | ||
HUMAN Security HUMAN Security protects digital interactions from bots, fraud, and abuse across advertising, applications, and accounts. | New York, United States | Private | |||
P Penta Security Penta Security develops web application firewalls, encryption and authentication products for enterprises and government agencies. | South Korea | 1997 | Private |
Also active in WAF and bot protection
15 companies| Company | Based in | Founded | Size | Ownership | Revenue |
|---|---|---|---|---|---|
Microsoft Microsoft sells software, cloud services, hardware, and gaming products. | Redmond, United States | 1975 | 228,000 staff | Public, MSFT | $331.8bn (FY2026) |
Fortinet Fortinet provides cybersecurity solutions and services, including networking and security convergence, for enterprises and governments. | Sunnyvale, United States | 2000 | 15,109 staff | Public, FTNT | $6.8bn (FY2025) |
Cloudflare Cloudflare provides a global network for security, performance, and full-stack development. | San Francisco, United States | 2009 | 2,440 staff | Public, NET | $2.2bn (FY2025) |
A10 Networks A10 Networks provides secure, high-performance networking solutions for applications and AI workloads. | San Jose, United States | 2004 | Public, ATEN | $290.6m (FY2025) | |
Amazon Web Services Amazon Web Services is a cloud computing platform that provides a wide range of services. | Seattle, United States | 2006 | Owned by Amazon | ||
Appdome Appdome provides a no-code platform for building security and anti-fraud defenses into mobile apps. | Redwood City, United States | Private | |||
Arcjet Arcjet provides runtime security for AI agents, enforcing policies at the action boundary. | San Francisco, United States | 2023 | Private | ||
Barracuda Networks Barracuda Networks provides cybersecurity solutions for email, networks, applications, and data. | Campbell, United States | 2003 | Owned by KKR | ||
Cequence Security Cequence Security protects applications, APIs, and AI agents from attacks and abuse. | Santa Clara, United States | 2014 | Private | ||
Comodo Group Comodo Group sells cybersecurity products and services to businesses and organisations. | Clifton, United States | 1998 | Private | ||
Fingerprint Fingerprint provides device intelligence to identify web and mobile visitors and prevent online fraud. | Chicago, United States | 2019 | Private | ||
Link11 Link11 provides DDoS protection and web application security services for companies. | Frankfurt am Main, Germany | Private | |||
Report URI Report URI is a client-side security platform that monitors and controls what runs in users' browsers. | Clitheroe, United Kingdom | 2017 | Private | ||
Contrast Security Contrast Security provides runtime application security that detects and blocks attacks from inside running applications. | Pleasanton, United States | Private | |||
Wallarm Wallarm provides an AI security and API security platform for enterprises running AI on AWS. | Austin, United States | Private |
Recent deals in WAF and bot protection
All WAF and bot protection dealsAcquisitions come from SecurityWeek's monthly M&A round-ups from 2021 onwards, from Cybersecurity Ventures' quarterly M&A reports for 2020, and a few from Wikipedia lists. These are dated to the month. A few deals added from the news are dated to the day. Smaller deals may be missing. Amounts are in US dollars.
More in Application Security
See every category- Application security testing vendors 58 companies
- Software supply chain security vendors 47 companies
- API security vendors 28 companies