Apigee Edge vs. Imperva Web Application Firewall (WAF)

Apigee has been great when managing the quota based access to the APIs. It is really good and suitable when considering proxying the in-house server endpoints access with the way it provides security with API Key validation and OAuth.

Incentivized

If you are looking for a cheap product to meet the bare minimum requirements for PCI or any other compliance regulations, this is not the product. Also, the WAF portion only inspects on HTTP/HTTPS traffic which can be very limiting into other forms of web apps that utilize other protocols. The HTTP/HTTPS inspection that it does do is very in depth and well worth the investment.

Incentivized

• Manage user access, we can allow specific access to users based on their need and even customize requests of services based on user requirements.
• Allow branding, so that SFO can maintain its look and feel but still get the support and functionalities we need from Apigee.
• Integrates well with other platforms we use.

Incentivized

• Alert Aggregation - Correlates different violations into perceived correlated attacks.
• Ease of deployment - as one of the only WAFs that allow bridge mode deployment, this can be deployed with without downtime and no Network Architecture modifications. If the need for proxy is required at a later time, Transparent Reverse Proxy can be deployed within seconds and minimal configuration.
• Custom Policies - Custom security policies are easy to configure.
• Reporting - There are a good amount of pre-configured reports available by default.

Incentivized

• Might need to bring in more features that a gateway performs, such a orchestration to some extent.
• May seem to be costly at start for small scale enterprises.

Incentivized

• The UI can use a little work (but is largely decent)

I am not the one deciding whether to use apigee or not really. But personally, I would recommend the use of it as developing APIs on it is easy. And as a mediator between backend servers, we could easily modify request and responses in it without touching any backend code while having a centralize gateway to access our backend APIs too.

Incentivized

Support has helped us to resolved all the queries and community support was also good.

Incentivized

There are just a couple of points that are hard to find, that probably could be elsewhere. But these are minor; everything else is right where you'd expect it to be.

Quite hard to get support, at least on the coding side, when we encounter blockers. But general concerns, they would schedule a call to you for them to get a whole picture of your concern. Albeit in my experience, bad really as they haven't replied about the progress, but otherwise seems to have been fixed.

Incentivized

We haven't needed support from Imperva since implementation. But during that time, their personnel were very quick to respond to questions. Since then, it's been largely doing its thing for us (which is exactly what we'd hoped).

Apigee is the best in the market in terms of API Analytics Apigee is having wonderful Documentation with short videos Security is a major concern and Apigee provides an easily configurable policy to secure API Quota and rate-limit is again very easy to configure on every API basis It provides various policies to transform the response from one form to another form e.g. JSON to XML or XML to JSON

Incentivized

Ultimately, it was the easiest to work with that was still a "known" company (we've been burned too many times by up-and-comers). We needed something that gave us a lot of control but then didn't need its handheld on a daily basis. Imperva gives us a lot of that and we are still able to navigate it with ease.

• Unruly, difficult to maintain, unable to test, difficult to troubleshoot and debug. Every ticket that requires Apigee work increases stress and anxiety.

Incentivized

• Our on-prem firewall has less work to do, allowing it more cycles for other tasks.
• We have better web traffic visibility and control over what actors are doing outside our network.