© 2026 Check Point Software Technologies Ltd. All Rights Reserved Page 1 of 3

Check Point WAF Alignment with Gartner Market Guide for Cloud WAAP (2025) In April 2025, Gartner published “Market Guide for Cloud Web Application and API Protection (WAAP)”, defining mandatory features and additional common features expected in web application market. We believe Check Point WAF is a leading solution enabling security teams to stay ahead of evolving threats while providing a comprehensive WAAP solution.

Mandatory Features defined in the Gartner Report-

Gartner Requirement

Check Point WAF Capabilities

Web Application Firewall (WAF)

��� Yes- Dual-layer AI/ML engine, blocks OWASP Top 10, zero- days (e.g., Log4Shell), no signatures needed.

DDoS Mitigation ��� Yes- Built-in DDoS protection with adaptive rate limiting, SaaS-based enforcement.

Bot Management ��� Yes- Client-side behavioral analysis blocks credential stuffing, scraping, and abuse etc.

API Protection ��� Yes-Full API lifecycle security including discovery, schema validation, and sensitive data exposure management.

Cloud-delivered Service

��� Yes-Fully cloud-delivered WAF-as-a-Service, deployable in minutes with multi-cloud support.

© 2026 Check Point Software Technologies Ltd. All Rights Reserved Page 2 of 3

Additional Common Features defined in the Gartner report-

Gartner Requirement

Check Point WAF Capabilities

Threat Intelligence ��� Yes Integrated with proprietary ThreatCloud AI for global, real-time detection.

Client-side Protection

DNS Security �� Not in current capability set.

Content Delivery Network (CDN)

��� Yes-Integrates mostly with all available external CDN providers for content caching and delivery optimization.

Rate Limiting ��� Yes-Advanced rate limiting including API-specific throttling and DDoS mitigation.

Mobile SDK �� Not in current capability set

Compliance ��� Yes- Compliance with various standards & frameworks, such as ISO/IEC 27001 , PCI DSS 4.1

Data Security/Control

��� Yes - Uses AI-driven prevention, behavioral analysis, and context-aware rules to detect and block unauthorized access to sensitive data in real time.

AI Capabilities �� �������� Yes- Native dual-layer AI/ML, behavioral analysis, and threat intelligence, Check Point is very strong in this area, combining real-time behavioral detection with contextual threat intelligence to proactively block advanced attacks.

Integrations ���Yes- Integrates with Kong API Gateway, For CI/CD integration-DevSecOps support, auto-policy enforcement in pipelines.

�� Yes - PCI DSS 4.1

�� Yes - Build in GenAI capability

© 2026 Check Point Software Technologies Ltd. All Rights Reserved Page 3 of 3

About Check Point WAF

Check Point WAF (formerly CloudGuard WAF) is a next-generation, cloud-native Web Application Firewall that transforms application and API security with multi-layered, AI- driven engines. Moving beyond traditional signature-based WAFs, it leverages contextual AI and behavioral analysis to detect and block sophisticated threats in real time. Through advanced decision engines, it identifies indicators of attack with precision ensuring high detection rates while keeping false positives near zero. Check Point WAF delivers comprehensive security with built-in protection for DDoS, bots, and rate limiting attacks, along with an integrated IPS. It also incorporates Check Point’s ThreatCloud intelligence to analyze files and detect malware before it reaches customer environment. This approach provides preemptive protection against both known and zero-day threats ensuring strong security without the need for constant manual tuning or complex configurations.

Learn More About Check Point WAF

Disclaimer: Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s Research & Advisory organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.

Gartner, Market Guide for Cloud Web Application and API Protection, By Esraa ElTahawy, Adam Hils, Aaron McQuaid, Dale Koeppen, 14 April 2025