About Check Point WAF Check Point WAF SaaS is a next-generation, cloud-native Web Application Firewall that transforms application and API security with multi-layered, AI-driven engines. Moving beyond traditional signature-based WAFs, it leverages contextual AI and behavioral analysis to detect and block sophisticated threats in real time. Through advanced decision engines, it identifies indicators of attack with precision ensuring high detection rates while keeping false positives near zero. Check Point WAF SaaS delivers comprehensive security with built-in protection for DDoS, bots, and rate limiting attacks, along with an integrated IPS. It also incorporates Check Point’s ThreatCloud intelligence to analyze file uploads and detect malware before it reaches customer environment. This intelligent, adaptive approach provides preemptive protection against both known and zero-day threats ensuring strong security without the need for constant manual tuning or complex configurations.

Built-In Resilience Against Modern DDoS Attacks In today’s hyperconnected world, where digital applications are central to business operations, ensuring application uptime and performance is no longer optional, it is mission critical. Yet, Distributed Denial of Service (DDoS) attacks continue to grow in frequency, size, and complexity, targeting vulnerabilities across infrastructure and web applications and APIs.

Check Point WAF SaaS delivers enterprise-grade, always-on DDoS protection natively embedded into the platform. It is engineered to absorb, mitigate, and respond to threats in real time through a globally distributed infrastructure. Customers don’t need to deploy, license or configure a separate DDoS service.

* Advance DDoS is part of Check Point WAF as a service offering only.

Build-In DDoS Protection with Check Point WAF SaaS

* Advance DDoS is part of Check Point WAF as a service offering only.

ADVANCED DDOS PROTECTION WITH Check Point WAF SAAS 2

Why DDoS Protection Matters More Than Ever Modern DDoS attacks have evolved beyond high-volume traffic floods. They now target multiple layers of the network stack, network (Layer 3), transport (Layer 4), and application (Layer 7) using methods such as complex HTTP floods, DNS query floods, and low-rate stealth attacks.

Even short-lived disruptions can lead to: • Revenue loss from downtime • SLA violations • Customer churn • Brand and reputational damage

Check Point WAF SaaS enables organizations to stay ahead of these evolving threats with cloud-native, intelligent, and scalable advanced DDoS protection eliminating the need for separate tools or dedicated infrastructure.

Check Point WAF Addresses the DDoS Challenge Global Presence for Instant Mitigation Check Point WAF SaaS utilizes a global network of Points of Presence (PoPs) to inspect and filter traffic at the edge before it impacts your infrastructure. This allows the platform to absorb large-scale volumetric attacks closer to their source, enhancing service availability and reducing latency for legitimate users.

Multi-Layered Defense Architecture Check Point WAF provides protection across all critical OSI layers:

• Layer 3/4 (Network/Transport): Automatically mitigates SYN floods, UDP floods, and reflection attacks. • Layer 7 (Application): Detects and blocks HTTP floods, API abuse, and DNS-based DDoS attacks using

behavior-based traffic analysis.

ADVANCED DDOS PROTECTION WITH Check Point WAF SAAS 3

How does it work? • Advanced detection engines in Check Point WAF SaaS continuously baseline and monitor traffic

patterns. When anomalies are detected, the system automatically mitigates the attack. • Very large volumetric attacks (up to several Terabits per second) as well as L3 and L4 attacks

will be blocked automatically at the edge from the moment of deployment and will ensure these attacks never reach your web application or API.

• During the first few days of deployment, the system baselines traffic patterns and within 3-7 days (when enough learning information is available), it will start blocking Layer 7 attacks.

• Upon attack, the Check Point DDoS Response Team will be alerted 24x7 and examine the attack. If needed, the customer will be contacted immediately.

• Attack information will automatically be visible in the web-user interface (available Q2’25).

Health-Based Adaptive Response Check Point WAF employs continuous health checks to dynamically adjust detection thresholds, ensuring that mitigation occurs only when necessary. This adaptive, health-based model minimizes false positives and helps maintain service quality even during attack events.

Real-Time Visibility and Deep Analytics An intuitive dashboard provides comprehensive insight into DDoS activity, offering: • Real-time traffic metrics (packet rates, dropped requests, error spikes) • DDoS event timelines • Auto-mitigation triggers • Forensic logs for post-event analysis

This transparency gives security teams the confidence and insight needed to take immediate action when necessary.

* Advance DDoS is part of Check Point WAF as a service offering only.

* Advance DDoS is part of Check Point WAF as a service offering only.

ADVANCED DDOS PROTECTION WITH Check Point WAF SAAS 4

Benefits of CCheck Point WAF DDoS Description

Built-In Defense Always-on, no setup required. Included in your Check Point WAF SaaS license.

Low Latency, High Availability Mitigation occurs at the edge, keeping users close and services up.

Real-Time Analytics Intuitive dashboards provide clear visibility into attack activity and mitigation actions.

Expert Support 24/7 24/7 access to the DDoS Response Team for real-time assistance.

Scalable & Elastic Automatically scale capacity to meet changing traffic demands.

Financial Protection Helps avoid unexpected infrastructure costs during DDoS attacks.

24/7 DDoS Response Team (DRT) Customers benefit from round-the-clock support by a global DDoS Response Team (DRT) that monitors, responds to, and advises on active threats in real time. From threat analysis and mitigation strategy to custom mitigation deployment, the DRT delivers the expertise required to maintain service continuity.

Seamless Scalability and Cost Efficiency Check Point WAF automatically scales to meet traffic demands during spikes, mitigating threats without manual intervention. This approach Helps avoid unexpected infrastructure costs during DDoS attacks is better

Flexible Control and Easy Integration With built-in API support and seamless DevOps compatibility, enabling DDoS policies to be managed efficiently across CI/CD pipelines. Customers can also define custom rules for rate-limiting, whitelisting, blacklisting, and other traffic control actions.

•

•

•

o

o

•

•

•

Worldwide Headquarters 5 Shlomo Kaplan Street, Tel Aviv 6789159, Israel | Tel: +972-3-753-4599

U.S. Headquarters 100 Oracle Parkway, Suite 800, Redwood City, CA 94065 | Tel: 1-800-429-4391

www.checkpoint.com

© 2026 Check Point Software Technologies Ltd. All rights reserved.

DDoS-CloudGuard_WAF_SaaS.pdf Binder1.pdf Real DDoS case