Imperva is a cybersecurity company, now part of Thales, focused on protecting applications, APIs, and data across cloud, hybrid, and on-premises environments. Its portfolio spans application security and data security, helping organizations reduce exposure to web attacks, bot abuse, DDoS events, API risk, client-side threats, and unauthorized access to sensitive data.
Imperva centers its business on two major domains: securing digital services that customers and partners interact with, and securing the data stores those services depend on. The company’s offerings are designed for enterprises modernizing applications, moving data to the cloud, and operating across mixed infrastructure while maintaining security, availability, and compliance.
Offerings, Capabilities, and Integrations
Imperva delivers layered protection for internet-facing applications and APIs together with data-centric controls for databases and broader data estates. Its capabilities cover threat detection and mitigation, policy enforcement, sensitive data visibility, risk analytics, incident context, and compliance support for organizations operating in complex hybrid and multi-cloud environments.
The portfolio supports flexible deployment models, including SaaS, cloud-native, virtualized, and on-premises implementations. Imperva also integrates with major cloud environments and cloud data services, offers marketplace-based procurement paths, and extends into security operations workflows through broad ecosystem integrations and automation-oriented deployment options.
Products and Services
- Imperva Application Security Platform: Imperva’s flagship application security platform for protecting applications and APIs with layered controls spanning attack prevention, bot mitigation, DDoS defense, client-side protection, and operational visibility.
- Imperva Web Application Firewall (WAF): Web application firewall offering that protects applications in cloud and on-premises environments with managed rules, automated policy creation, attack analytics, and blocking for common web exploits.
- Advanced Bot Protection: Bot management solution that protects websites, mobile applications, and APIs from automated abuse such as scraping, fraud, scalping, and credential-based attacks without disrupting legitimate users.
- Unified API Security Platform: API security offering focused on discovery, classification, risk assessment, schema-aware protection, and mitigation of API threats, including business logic abuse and BOLA-related risks.
- DDoS Protection: Always-on protection for volumetric, protocol, and Layer 7 DDoS attacks across websites, networks, and individual IP assets, with fast mitigation designed to preserve uptime.
- DNS Protection: Authoritative DNS protection service that combines DNS DDoS mitigation, global Anycast resilience, traffic visibility, and policy control to keep applications reachable.
- Client-Side Protection: Client-side security offering that gives security teams visibility and control over third-party JavaScript to reduce formjacking, digital skimming, Magecart, and related supply-chain fraud risks.
- Account Takeover Protection: Fraud-focused protection for login endpoints that uses multilayered detection and machine learning to stop credential stuffing, brute force activity, and account takeover attempts.
- Data Security Fabric: Imperva’s flagship data security platform for hybrid and multicloud environments, providing centralized visibility, monitoring, analytics, policy controls, and protection across diverse data repositories.
- Data Security Posture Management: Data security posture management capability for assessing data risk, strengthening governance, and improving visibility into where sensitive data resides, who can access it, and how it is protected.
- Cloud Data Protection: Data-centric protection for cloud, DBaaS, and hybrid database environments, with native integrations for a broad range of cloud database services and support for multi-cloud security operations.
- Imperva for Google Cloud: Cloud-native application security offering for Google Cloud that integrates with Google Cloud Load Balancing and Private Service Connect to protect web applications and APIs without disruptive rerouting.
- Imperva Services: Professional, managed, and training services that support planning, deployment, monitoring, incident readiness, optimization, and operational maturity across Imperva implementations.
Target Customers
Imperva primarily serves enterprises that run business-critical web applications, APIs, and data platforms across cloud, hybrid, and on-premises estates. Its offerings fit organizations that need strong application availability and protection while also maintaining visibility and control over sensitive data.
The company is especially relevant for regulated and high-risk sectors with demanding compliance and uptime requirements, including financial services, retail and eCommerce, healthcare, government, and telecom. It also targets security, platform, and compliance teams supporting cloud migration, digital service delivery, and modern API-driven environments.
Cloud Integrations and Marketplace
- AWS Marketplace: Imperva maintains AWS Marketplace presence for application security offerings, including WAF-related deployments, and supports AWS environments as part of its broader application and data security portfolio.
- Azure Marketplace: Imperva has verified Azure Marketplace listings for application security and database monitoring-related deployments, supporting Azure-based implementations through marketplace procurement and virtual appliance options.
- Google Cloud Marketplace: Imperva offers Google Cloud Marketplace availability for its application security portfolio, including Imperva for Google Cloud, which is designed to operate natively with Google Cloud traffic handling and deployment workflows.
- Oracle Cloud Marketplace: Imperva Data Security Fabric is available through Oracle Cloud Marketplace for OCI-focused data security use cases, including protection of sensitive workloads during cloud migration and ongoing operations.
Key People
- Sebastien Cano: Senior Vice President of Cyber Security Products
- Rob Elliss: Vice President of Worldwide Sales, Application & Data Security
- Tim Chang: Vice President of Application Security Products
- Todd Moore: Vice President of Data Security Products
- Ashvin Kamaraju: Vice President of Engineering
- Poupak Modirassari-Enbom: Vice President of Global Marketing
- Michelle Forbrigger: Vice President of Human Resources
- Christine Draper: Vice President of Finance
- Lionel Merrien: Vice President of Strategy & Innovation
- Steve Walden: Vice President of Global Business Operations
- James Muse: Vice President of General Counsel & Compliance Officer
- Raphaël de Cormis: Vice President of Integration
Key Facts
- Headquarters: Austin, Texas, United States
- Employees: 1,300+
- Annual Revenue: $500M+
- Parent Company: Thales
- Subsidiaries: 15+ international legal entities and subsidiaries, including Imperva UK Limited, Imperva Sweden AB, Imperva Singapore Pte Ltd, and Imperva France SARL
- Publicly Listed: No; subsidiary of publicly traded Thales (Euronext Paris: HO)
Analyst Recognitions
- Forrester: Leader in The Forrester Wave™: Web Application Firewall Solutions, Q1 2025. Leader in The Forrester Wave™: DDoS Mitigation Solutions, Q1 2021. Leader in The Forrester New Wave™: Bot Management, Q1 2020.
- Gartner: Customers’ Choice in Gartner Peer Insights™ Voice of the Customer for Cloud Web Application and API Protection, 2024. Leader in Gartner® Magic Quadrant™ for Web Application and API Protection (WAAP), 2022.
