Skip to content
SPECIFICTION
Get listed

Imperva API Security

imperva.com

Free trial WebAPISelf-hosted
Visit imperva.com
Spec score 8.2 #3 of 35 in Web Application Firewall Software

What it is

Imperva API Security brings API discovery, risk assessment, detection, and mitigation into one console for cloud, on-premises, and hybrid environments. It monitors public, private, and shadow APIs, tracks changes, and identifies design flaws and vulnerabilities. Ongoing assessments address risks associated with the OWASP API Security Top 10. For Broken Object Level Authorization, its machine-learning-driven detection profiles traffic for behavioral changes and can block exploits. A separate testing function scans uploaded API specifications for posture gaps, design and configuration weaknesses, and risky endpoints. Teams can choose cloud-managed or self-managed management, with agent-based or agentless deployment options for cloud WAF, microservices, encrypted applications, and network-layer monitoring. Integrations include Kong, Mulesoft, Azure APIM, Apigee, and F5. API sensitivity classification includes government IDs, card details, addresses, and other personal information. With Imperva’s application security platform, it addresses nine OWASP API Top Ten risks; Unsafe Consumption of APIs is not covered. It runs on API, self-hosted, and web platforms. Pricing is on request; there is no free plan, and a 30-day trial may be limited to 100 Mbps, with excess traffic potentially null-routed.

Spec sheet

What it does
Imperva API Security unifies API discovery, risk assessment, threat detection and mitigation across cloud, on-premises and hybrid environments.Read 15 Oct 2026 · imperva.com
Integrations
Named integrations include Kong, Mulesoft, Azure API Management, Apigee and F5.Read 15 Oct 2026 · imperva.com
Support
Imperva provides technical support, services, Imperva University, a community, a support portal, and documentation resources.Read 1 Oct 2026 · imperva.com
Headquarters
United StatesRead 28 Sep 2026 · imperva.com
Founded
Imperva, Inc. was incorporated in April 2002.Read 15 Oct 2026 · sec.gov
API classification
It classifies APIs and sensitive data such as government IDs, payment-card data, addresses and other PII.Read 15 Oct 2026 · imperva.com
API discovery
The service continuously discovers public, private, undocumented and shadow APIs and keeps an inventory current.Read 15 Oct 2026 · imperva.com
API documentation scope
The public API documentation covers account and service management, policy updates, monitoring, audit retrieval, alerting integrations, users, API keys and subscription metrics.Read 15 Oct 2026 · docs-cybersec.thalesgroup.com
API testing
API Security Testing scans uploaded API specifications, ranks posture and configuration issues by severity, and supplies developer fixes.Read 15 Oct 2026 · imperva.com
API verification
API verification assesses specifications and generates targeted fuzzing tests based on discovered API behavior.Read 15 Oct 2026 · imperva.com
BOLA protection
Its ML-driven BOLA Detection and Response profiles traffic, detects behavioral deviations, and can block Broken Object Level Authorization exploits.Read 1 Oct 2026 · imperva.com
BOLA response
ML-based behavioral profiling can detect and automatically block Broken Object Level Authorization attacks in real time.Read 15 Oct 2026 · imperva.com
Bot integration
Sensitive or abuse-prone APIs can be sent to Imperva Advanced Bot Protection for automated-threat mitigation.Read 15 Oct 2026 · imperva.com
Bot protection
Imperva API Security integrates with Advanced Bot Protection to identify sensitive APIs, detect bot attacks, and apply tailored mitigation policies.Read 1 Oct 2026 · imperva.com
Business-logic protection
Hybrid behavioral and rule engines score anomalies and identify business-logic abuse, including BOLA.Read 15 Oct 2026 · imperva.com
Company ownership
Thales agreed in July 2023 to acquire 100% of Imperva from Thoma Bravo for a $3.6 billion enterprise value; completion was announced in December 2023.Read 15 Oct 2026 · cpl.thalesgroup.com
Company size
LinkedIn lists Imperva as a privately held Thales company with 10,001-plus employees and Austin, Texas headquarters.Read 15 Oct 2026 · linkedin.com
Core licensing
An independent product comparison describes Imperva API Security as proprietary rather than open source.Read 15 Oct 2026 · comparisec.com
Deployment choices
Customers can use cloud-managed or self-managed local-console deployment, with agent-based or agentless options.Read 15 Oct 2026 · imperva.com
Deployment options
Deployment options include cloud-managed or self-managed management, plus agent-based or agentless setups for cloud WAF, microservices, encrypted applications, and network-layer monitoring.Read 1 Oct 2026 · imperva.com
Deployment topologies
The product supports cloud WAF, microservices, encrypted applications, network monitoring, Kubernetes sensors, sidecar sniffers and standalone network sniffers.Read 15 Oct 2026 · imperva.com
Documentation portal
Imperva maintains a searchable documentation portal and a separate Thales-hosted API reference library.Read 15 Oct 2026 · docs.imperva.com
Free-trial limit
The 30-day trial may be limited to 100 Mbps bandwidth, with traffic above that threshold potentially null-routed.Read 1 Oct 2026 · imperva.com
Intended customers
Imperva says its solutions serve 6,200-plus enterprise customers in 150 countries, including major banks, financial-services firms, telecom providers, and Fortune 100 companies.Read 1 Oct 2026 · imperva.com
Limit: complex architectures
A Gartner review says the product can focus on edge inventory and lack deep detection and protection for complex API architectures.Read 15 Oct 2026 · gartner.com
Limit: customization and reporting
G2 feedback requests more custom-policy options and notes that security-event reports can be emailed but not downloaded.Read 15 Oct 2026 · g2.com
Limit: false positives
Trustpilot complaints repeatedly describe genuine users being blocked, CAPTCHA loops, error codes 15/17 and random IP blocking.Read 15 Oct 2026 · trustpilot.com
Limit: price
G2 reviewers repeatedly describe the solution as expensive or high priced.Read 15 Oct 2026 · g2.com
Limit: support and documentation
One G2 reviewer reports slow support response and resolution times and sparse related documentation.Read 15 Oct 2026 · g2.com
Notable news
Imperva announced unified real-time API detection and response, including BOLA mitigation, on June 24, 2025.Read 15 Oct 2026 · imperva.com
Open-source integration
A separate public Python integration tool is MIT licensed and connects Cloud API Security with 3scale, Azure API Management, Amazon API Gateway and filesystem sources.Read 15 Oct 2026 · github.com
OWASP coverage
The datasheet says the combined Imperva application-security platform covers nine of the ten OWASP API risks, excluding unsafe consumption of APIs.Read 15 Oct 2026 · imperva.com
Praise: speed and accuracy
G2 reviewers praise fast performance, strong quality and few false positives.Read 15 Oct 2026 · g2.com
Praise: usability
G2 reviewers mention easy deployment, a user-friendly dashboard, security and compliance coverage, and straightforward integrations.Read 15 Oct 2026 · g2.com
Praise: visibility
Gartner reviewers describe reliable discovery of previously unseen APIs, clearer traffic visibility and useful real-time protection.Read 15 Oct 2026 · gartner.com
Public API
Imperva documents REST APIs authenticated with API ID and API key headers for service onboarding and configuration.Read 15 Oct 2026 · docs-cybersec.thalesgroup.com
Rating on G2
4.3 out of 5 from 3 reviewsRead 15 Oct 2026 · g2.com
Rating on Gartner Peer Insights
4.5 out of 5 from 97 reviewsRead 15 Oct 2026 · gartner.com
Rating on Trustpilot
1.5 out of 5 from 26 reviewsRead 15 Oct 2026 · trustpilot.com
Risk assessment
Risk analysis maps API design flaws and vulnerabilities to the OWASP API Security Top 10.Read 15 Oct 2026 · imperva.com
SDK
Imperva publishes a Python object-oriented SDK for the SecureSphere Open API with JSON import and export support.Read 15 Oct 2026 · github.com
Security certifications
Imperva’s ESG material lists GDPR, APEC Privacy, PCI DSS, ISO 27001 and SOC 2 Type II validations or certifications.Read 15 Oct 2026 · imperva.com
Sensitive-data classification
The product classifies APIs by sensitivity categories including government ID, credit card details, address information, and other personally identifiable information.Read 1 Oct 2026 · imperva.com
Shift-left workflow
OpenAPI scanning can produce prioritized fixes and CI/CD annotations before code is released.Read 15 Oct 2026 · imperva.com
Unified platform
Imperva API Security manages API discovery, risk assessment, detection, and mitigation in one console across cloud, on-premises, and hybrid environments.Read 1 Oct 2026 · imperva.com

Plans and prices

Free trial Free 30 days Cloud WAF, DDoS, Bot Protection and CDN included · trial bandwidth may be limited to 100 Mbps Read 15 Oct 2026 · imperva.com
Imperva API Security Priced on request Contact sales Enterprise API security; Cloud WAF add-on or API Security Anywhere Read 15 Oct 2026 · imperva.com

Every Imperva API Security plan and price →

Strong points and limits

Strong points

  • Discovers public, private, and shadow APIs.
  • Scans uploaded API specifications for weaknesses.
  • Can block detected BOLA exploits.
  • Integrates with Kong, Mulesoft, Azure APIM, Apigee, and F5.
  • Supports cloud-managed and self-managed deployment.

Limits

  • Pricing is available only on request.
  • There is no free plan.
  • Trial bandwidth may be limited to 100 Mbps.
  • Unsafe Consumption of APIs is the OWASP exception.

Who it suits

It suits organizations managing APIs across cloud, on-premises, or hybrid environments, particularly teams needing discovery, testing, and runtime protection. The maker describes its customers as including banks, financial-services firms, telecom providers, and large enterprises.

Verdict

Imperva combines API inventory, assessment, testing, and threat mitigation across multiple deployment environments. Review the trial bandwidth condition and request pricing before evaluating it for your needs.

Where Specifiction places it

Alternatives to Imperva API SecurityAll alternatives →