Akamai App & API Protector
Web application firewall, bot and DDoS protection for websites and APIs.
Network Segmentation
Web application firewall and DDoS protection
Websites and APIs stay up, and common web attacks are filtered before they reach them.
Addresses 36 stories in our coverage in the last 90 days 4 products that provide it
What it is
A protective layer in front of websites and APIs that absorbs denial-of-service floods and blocks injection attacks, bots and abuse.
How to value it
DDoS attacks by hacktivists against European organisations are a recurring news item, and an hour of downtime for a customer-facing site has a direct cost. A web application firewall also buys time when a flaw in a web application is published before you can patch it.
Questions to ask a vendor
- 1What is the mitigation capacity, and is DDoS protection unmetered?
- 2How fast can you deploy a virtual patch for a new vulnerability?
- 3Does it protect APIs as well as websites?
- 4Where is traffic inspected, and what does that mean for data residency?
For your risk register
- Risk
- Outage of customer-facing services through DDoS, or exploitation of web application flaws.
- Control
- Web application firewall and DDoS protection on all public web services.
- Owner
- Web platform lead.
- Measure
- Share of public services behind the protection layer.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
Cloudflare WAF and DDoS protection
Web application firewall and unmetered DDoS mitigation for websites and APIs.
F5 Web App and API Protection
Web application firewall, API security, bot management and DDoS mitigation, as a service or self-managed.
Imperva Cloud WAF
Cloud web application firewall with DDoS and bot protection.
Recent stories it addresses
106 stories in total- 18 Oct 2026Hackers exploit SiteGuard WAF flaw to run commands as admins
Hackers exploit SiteGuard WAF flaw to run commands as admins.
- 14 Oct 2026Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
Researchers used public AI to build a Chrome exploit in six days, earning $250,000.
- 7 Oct 2026ShinyHunters Extorted Boeing Spin-off Prior to Arrests
ShinyHunters leader 'Rey' arrested, cooperating with FBI; Boeing unit extorted.
- 7 Oct 2026Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
Atlassian Data Center products exploited for arbitrary file access within two hours of public details.
- 6 Oct 2026Atlassian warns of critical file-access flaw in Jira, Confluence
Atlassian warns of critical arbitrary file access flaw in self-hosted Jira, Confluence, Bitbucket.
- 2 Oct 2026AI Agents Aimed SQL Injection at US and Canadian Government Sites
AI agents attempted SQL injection attacks on US and Canadian government websites.
- 1 Oct 2026Vulnerability & Patch Roundup — September 2026
September 2026 WordPress vulnerability roundup includes critical flaws in WooCommerce and WPForms.
- 28 Sept 2026Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign
ShinyHunters launches mass-exploitation campaign targeting Oracle PeopleSoft CVE-2026-35273 with modified WAF-bypass
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.