Cloudflare named a Leader in WAF by Forrester

Cloudflare Tops WAF Strategy Scores in Forrester Wave Report

Forrester has named Cloudflare a Leader in The Forrester Wave™: Web Application Firewalls, Q3 2022. The evaluation assessed 12 web application firewall (WAF) providers against 24 criteria spanning current offering, strategy, and market presence.

Cloudflare earned the highest score of all evaluated vendors in the strategy category. It also achieved top marks in 10 individual criteria, including innovation, management UI, rule creation and modification, Log4Shell response, incident investigation, and security operations feedback loops.

“Cloudflare Web Application Firewall shines in configuration and rule creation” — Forrester

Forrester also noted Cloudflare's active online user community, associated response time metrics, and suitability as a choice for organizations prioritizing usability and a unified application security platform.

Log4Shell Response Demonstrates WAF Value

A WAF's core job is preventing compromise attempts against web applications, where a successful exploit can lead to full application takeover and data exfiltration. The Log4Shell vulnerability highlighted in the Forrester report illustrates this in practice.

Log4Shell, disclosed December 9, 2021, was a critical remote code execution vulnerability in Apache Log4J, a widely used logging library for Java applications. Given the component's popularity, countless organizations were potentially exposed immediately after public disclosure.

Cloudflare's response involved deploying managed rules with block actions to shut down exploit attempts before they reached customer applications. The rules were globally available to all Cloudflare WAF customers in under 17 hours. In the weeks that followed, Cloudflare updated those rules repeatedly as new attack payload variations and related CVEs emerged.

Cloudflare also published ongoing updates on the vulnerability's severity, internal response processes, and remediation steps. The net effect was that the WAF bought organizations time to patch backend systems before attackers could find and exploit vulnerable applications.

A Longstanding Core Offering

The WAF has been part of Cloudflare's product portfolio since the company's founding, alongside CDN and DDoS mitigation services. The recognition arrives during Cloudflare's Birthday Week, when the company highlights product milestones and releases.

Organizations can use Cloudflare WAF alongside API security, DDoS protection, bot management, and third-party JavaScript monitoring from a single console. The report is available for complimentary download, and new users can sign up for a Cloudflare account to get started with the WAF.