Web application firewalls · November 2026 Edition
Cloudflare WAF vs Imperva Cloud WAF
Thirteen of fourteen models named Cloudflare WAF first on the direct prompt; zero named Imperva Cloud WAF. Both were named by all fourteen models and Cloudflare WAF carries 70 labels and Imperva Cloud WAF 46, so the shares are not directly comparable.
Named in two categories this edition.
Named in one category this edition.
First-choice share85%2%Of first choices across the direct, paraphrase, budget and scale prompts, 0 to 100.
Negative rate6%20%Negative labels as a share of the product's labels, 0 to 100.
Rank in category#1#4A position in a field of 12; printed, not drawn.
Labels7046A count; the two differ.
The two percentage rows are drawn on one 0 to 100 track, Cloudflare WAF reading right to left. Rank and label count are printed, not drawn.AWS WAF was named alongside these two in twelve of the fourteen direct answers. Cloudflare WAF vs Sucuri WAF · Cloudflare WAF vs AWS WAF · Cloudflare WAF vs Barracuda WAF
Share is the count of first choices across the direct, paraphrase, budget and scale prompts over all fourteen models, for a mid-market B2B company; rank is within the category; every quote names the model and the prompt it came from. Both figures come from the web application firewalls page.
By framing
How many of the fourteen models made each the first choice, per way of asking, and how many argued against it.
Cloudflare WAFFirst choices, of fourteen modelsImperva Cloud WAF
Direct1303 against Imperva Cloud WAF
Paraphrase130
Comparative81
Budget-constrained1101 against Cloudflare WAF · 2 against Imperva Cloud WAF
Scale-constrained21
Negative003 against Cloudflare WAF · 4 against Imperva Cloud WAF
Bars are first choices, 0 to 14 each sideModels that argued againstA model can name both, so the two sides of a row do not sum to fourteen.
Across every category in the November 2026 Edition, Cloudflare WAF and Imperva Cloud WAF were named in the same answer 137 times, of the 219 answers naming Cloudflare WAF and the 145 naming Imperva Cloud WAF. In those answers Imperva Cloud WAF took the first choice ten times and Cloudflare WAF eighty-seven.
Every model, every framing
The eighty-four answers behind the chart above, one cell each: where Cloudflare WAF and Imperva Cloud WAF stood in it.
| Model | Direct | Paraphrase | Comparative | Budget-constrained | Scale-constrained | Negative |
|---|---|---|---|---|---|---|
| Claude Haiku 4.5 | | | | | | |
| GPT-5.4 mini | | | | | ||
| Gemini 3.5 Flash | | | | | | |
| Perplexity Sonar | | | | | ||
| Grok 4.20 | | | | | | |
| Mistral Small | | | | | | |
| DeepSeek V4 Flash | | | | | | |
| Llama 4 Maverick | | | | |||
| Qwen 3.7 Flash | | | | | ||
| Kimi K2 | | | | | | |
| GLM 4.7 FlashX | | | | | ||
| MiniMax M2.5 | | | | |||
| GPT-6 Luna | | | | | ||
| Muse Glimmer 30B | | | | |
Cloudflare WAF Imperva Cloud WAF first choice named as an alternative argued againstblank: not namedEach cell is one answer, Cloudflare WAF on the left and Imperva Cloud WAF on the right.The direct prompt
The plain question, one answer per model, grouped by where Cloudflare WAF and Imperva Cloud WAF stood in it.
Cloudflare WAF first, Imperva Cloud WAF an alternative
13 of 14 modelsImperva Cloud WAF was named in the answer but not as the choice, or not at all.GPT-5.4 miniCloudflare WAF alternatives: AWS WAF, F5 Distributed Cloud WAF, Fastly Next-Gen WAF
Gemini 3.5 FlashCloudflare WAF alternatives: AWS WAF, Fastly Next-Gen WAF, Imperva App Protect
Perplexity SonarCloudflare WAF alternatives: AWS WAF, Barracuda WAF, Fastly Next-Gen WAF
Grok 4.20Cloudflare WAF alternatives: AWS WAF, Azure WAF, Barracuda WAF, Fastly Next-Gen WAF
Mistral SmallCloudflare WAF alternatives: AWS WAF, Imperva SecureSphere
DeepSeek V4 FlashCloudflare WAF alternatives: AWS WAF, Barracuda WAF-as-a-Service, Imperva Application Security
Llama 4 MaverickCloudflare WAF
Qwen 3.7 FlashCloudflare WAF alternatives: AWS WAF, Azure Front Door, F5 Distributed Cloud WAF, Imperva Cloud WAF
Kimi K2Cloudflare WAF alternatives: AWS WAF, Imperva Cloud WAF
GLM 4.7 FlashXCloudflare WAF alternatives: AWS WAF, Imperva Cloud WAF
MiniMax M2.5Cloudflare WAF alternatives: AWS WAF, Azure WAF, Fastly Next-Gen WAF, Fortinet FortiWeb, Google Cloud Armor, Imperva Cloud WAF, Radware Cloud WAF Service
GPT-6 LunaCloudflare WAF alternatives: AWS WAF
Muse Glimmer 30BCloudflare WAF alternatives: AWS WAF, Barracuda Web Application Firewall
Neither was the first choice, one was named
1 of 14 modelsThe answer put something else first and named one of the two as an alternative.Claude Haiku 4.5Barracuda WAF alternatives: Cloudflare WAF, Microsoft Azure WAF
Bold names in an answer are the products the judge labeled a first choice; a model naming several gives each of them that label. The full answer text for every row is in the record.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment and they are never added together. The figures above are the mid-market standing, which is the one the category orders by.
Small business
Cloudflare WAF leads by ninety-four points.
Cloudflare WAF94%#1 of 9Imperva Cloud WAF0%#9 of 9Mid-marketThe figures above
Cloudflare WAF leads by eighty-three points.
Cloudflare WAF85%#1 of 12Imperva Cloud WAF2%#4 of 12Enterprise
Cloudflare WAF leads by forty points.
Cloudflare WAF60%#1 of 9Imperva Cloud WAF19%#2 of 9What the models said about Cloudflare WAF
Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Six of eight in this category shown.
“Popular and low-latency, but criticized for outdated ModSecurity rules, support delays (e.g., 48+ hours), latency in some cases, false negatives, and bypasses” Grok 4.20 · negative prompt · soft negative
“A significant 2024 vulnerability (discovered by Zafran) revealed a pervasive misconfiguration bug affecting these major WAF providers” Kimi K2 · negative prompt · soft negative
“These avoid high licensing costs (often $5K–$50K+/year for commercial tools like Cloudflare Enterprise, AWS WAF, or Imperva)” Grok 4.20 · budget prompt · soft negative
“For most mid‑market B2B companies the Cloudflare WAF is the easiest, most cost‑effective way to get enterprise‑grade protection today.” MiniMax M2.5 · direct prompt · first choice
“Cloudflare WAF with Bot Manager is the best overall choice due to its strong security, ease of deployment, and cost-effective pricing” Mistral Small · paraphrase prompt · first choice
“For most small‑to‑midsize companies on a tight budget, Cloudflare’s free or low‑cost WAF tier is the best starting point.” GLM 4.7 FlashX · budget prompt · first choice
What the models said about Imperva Cloud WAF
Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Six of eight in this category shown.
“Imperva SecureSphere due to the documented critical bypass CVEs.” DeepSeek V4 Flash · negative prompt · hard negative
“Avoid enterprise solutions (Imperva, Akamai, F5)” DeepSeek V4 Flash · budget prompt · hard negative
“Effective for bots/anti-bot but cracked in some 2023 attacks; bypasses with double encoding or anti-bot evasion. High cost and tuning needs.” Grok 4.20 · negative prompt · soft negative
“Top security efficacy scores (100% in recent SecureIQLab testing), strong API security, fully managed options | Companies wanting maximum protection with minimal in-house effort” DeepSeek V4 Flash · scale prompt · first choice
“Cloudflare and Imperva often score highest in detection rate (70-90%+) with balanced false positives” Grok 4.20 · comparative prompt · first choice
“For enterprise-grade security with data-layer coverage: Imperva WAF offers comprehensive protection and hybrid deployment options.” GLM 4.7 FlashX · comparative prompt · alternative
Also compared
Comparisons are drawn for the top eight products in each category, each against each. The output is the models' output; nothing here is a recommendation by the index.