In short: Check Point CloudGuard WAF, formerly CloudGuard AppSec, is a web application and API protection service. It uses machine learning engines to block OWASP Top 10 and zero-day attacks without signature tuning, discovers APIs, prevents bots and scans uploads. It runs as WAF-as-a-service or on gateways, Kubernetes ingress, Docker and Linux, managed in the Infinity Portal.
What CloudGuard WAF is
CloudGuard WAF is Check Point's web application firewall and API protection product. It was previously called CloudGuard AppSec, and Check Point's own site now often brands it simply as Check Point WAF, so you may see all three names. It sits in the Check Point CloudGuard family. Under Check Point's 2025 partnership with Wiz, CNAPP posture management moved to Wiz, while Check Point kept its own cloud network security and WAF products; see the Check Point cloud security portfolio.
It is designed for organisations that want WAF protection across a mix of public websites, customer portals, APIs and containerised applications without a large rule-tuning effort. For the general principles, read our web application firewall guide.
How detection works
CloudGuard WAF does not rely on signatures for its core protection. Check Point describes two machine learning engines working together:
- An attack-indicator engine (supervised), trained on large sets of malicious and legitimate web requests to recognise attack patterns
- A contextual analysis engine (unsupervised), which learns the normal behaviour of each of your applications and its users
Each request is scored on how likely it is to be malicious, taking into account the request content, user behaviour and context. Check Point states this approach protects against the OWASP Top 10 and zero-day attacks, and cites blocking high-profile vulnerabilities such as Log4Shell and Spring4Shell without needing a software update. As with any WAF, we recommend running in learning or detect mode against your real traffic before switching to prevention.
The same engine is available as open source under the open-appsec name, which some teams use to evaluate the approach.
Capabilities
Alongside core web protection, CloudGuard WAF includes:
- API discovery and protection: discovers APIs, including undocumented shadow and outdated zombie endpoints, by analysing traffic, keeps time-stamped snapshots of changes and blocks requests that do not match the expected schema
- Bot prevention: an anti-bot engine that distinguishes automated abuse from real users
- Intrusion prevention: an IPS engine covering known web CVEs, with support for custom Snort signatures
- Rate limiting: caps on the number of requests to a URI in a set time window
- File security: scans uploaded files against Check Point's threat intelligence, with block, quarantine or allow actions by policy
- DDoS protection: covers network-layer floods and application-layer HTTP floods, with behaviour-based analysis
- GenAI application protection: a layer powered by Lakera that targets prompt injection, data leaks and harmful content in AI-powered applications you publish
If you need to govern staff use of public AI tools rather than protect your own AI applications, see Check Point Workforce AI Security.
Deployment options
| Model | Where it runs | Typical use |
|---|---|---|
| WAF-as-a-service | Check Point's cloud edge, via global points of presence; you route traffic by DNS | Public websites and portals, fastest to deploy |
| Cloud and virtual gateways | Check Point-provided gateway virtual machines in public cloud (including Azure) or VMware | Applications in your own cloud or data centre |
| Kubernetes ingress | NGINX, Kong or Istio ingress controllers | Containerised applications and microservices |
| Docker | A Check Point reverse proxy container, or an agent beside your own NGINX, Kong or Envoy proxy | Container hosts and smaller estates |
| Linux agent | Alongside NGINX or Kong on a Linux server | Existing web servers you do not want to re-architect |
All deployments are managed centrally in the Check Point Infinity Portal, where you define protected assets, profiles and policies and then enforce them. Check Point notes there is no full-sync high availability between instances, although most options can scale behind a load balancer. Configuration can also be automated through Check Point's API and Terraform (Terraform does not currently cover the WAF-as-a-service model), which suits teams who manage infrastructure as code. Where Check Point gateways already protect your cloud networks, see CloudGuard Network Security.
Who CloudGuard WAF suits
CloudGuard WAF is a good fit for:
- Organisations with applications in several places, such as a website on one host, a portal in Azure and APIs in Kubernetes, that want one policy and console
- Teams without time for signature tuning, because the machine learning approach is designed to reduce manual rule maintenance
- API-heavy applications that need discovery and schema enforcement
- Existing Check Point customers who want WAF in the same Infinity Portal as their other Check Point services
If every application is in Azure and your needs are simple, Azure Web Application Firewall may be enough, and we will say so. CloudGuard CNAPP posture management is a different product with a different future; see Check Point CloudGuard CNAPP and the move to Wiz.
Licensing and how we help
CloudGuard WAF is sold as a subscription, and the licensing depends on the deployment model and the applications you protect. Check Point also publishes the engine as open source (open-appsec) for teams that want to evaluate it first. Plan detail is on Software Licensing UK. For pricing, ask us for a quote.
We list your applications and APIs, choose the deployment model for each, deploy in learning mode, review what the WAF sees with you and then move to prevention. To discuss CloudGuard WAF, contact us.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is CloudGuard WAF the same as CloudGuard AppSec?
Yes. CloudGuard AppSec was renamed CloudGuard WAF. Check Point's website now often calls it Check Point WAF, but it is the same web application and API protection product.
Does CloudGuard WAF use signatures?
Its core protection uses machine learning rather than signatures: a supervised engine trained on attack and legitimate traffic, and an unsupervised engine that learns each application's normal behaviour. It also includes intrusion prevention for known vulnerabilities.
Can CloudGuard WAF protect Kubernetes applications?
Yes. It can be deployed as a Kubernetes ingress using NGINX, Kong or Istio, as well as in Docker, on Linux alongside NGINX or Kong, on cloud gateway virtual machines or as WAF-as-a-service.
What is open-appsec?
open-appsec is the open-source version of Check Point's machine learning WAF engine. It lets teams evaluate the approach or run it themselves, while CloudGuard WAF adds the managed service and central management in the Infinity Portal.
How is CloudGuard WAF licensed?
It is sold as a subscription, and the licensing depends on whether you use WAF-as-a-service or a self-managed deployment and on the applications you protect. Ask us for a quote based on your applications and how you want to deploy.