I feel Check Point WAF is very basic but it does its job well in protecting the organization. It definitely helps when an employee is clicking on a suspicious link, like, preventing phishing attacks. I appreciate that it logs everything so that the SOC team stays aware. The feature I love the most is the firewall policy management and log monitoring via the smart console. I regularly work on analyzing the logs to investigate issues and validate security alerts. I also use the threat prevention features like IPS and antivirus to understand patterns and tune rules. Review collected by and hosted on G2.com.

I feel the setup is very complex and quite lengthy. It also has a high cost, and the performance impact is a bit lagging. It increases latency, reduces throughput, and needs proper sizing and tuning. I request the Check Point team to hopefully make the process easier. Review collected by and hosted on G2.com.

What I like best is the contextual AI engine that detects threats without relying on constant signature updates. It dramatically cut down our false positives compared to our previous signature-based WAF, which means less time spent tuning rules and chasing noise. Deployment across our cloud environments was straightforward, and the automatic learning of application behavior means new apps get protected without a ton of manual configuration. The unified management through the Infinity portal is also a big plus for us since we can see everything in one place. Review collected by and hosted on G2.com.

The initial setup and configuration felt more complex than expected, and the learning curve for tuning rules to reduce false positives was steep. Documentation could be more thorough in places, and support response times occasionally lagged when we ran into urgent issues. Pricing also feels on the higher side compared to some alternatives, especially as you scale traffic. Better dashboards and more intuitive policy management would go a long way Review collected by and hosted on G2.com.

I like Check Point WAF because it provides strong protection against web application attacks while being easy to deploy and manage. Its automated policy generation, AI-driven threat detection, and low false positive rate reduce administrative effort without compromising security. I also appreciate its support for cloud environments, API protection, and centralised management, making it a reliable solution for securing modern web applications. Review collected by and hosted on G2.com.

One area that could be improved is making the platform even more intuitive for new users, especially when configuring advanced security policies. However, the available documentation and automation features help reduce the learning curve, and overall the solution provides strong security capabilities and flexibility. Review collected by and hosted on G2.com.

I like that Check Point WAF is easy to use and gives good protection without needing too much manual work all the time. It helps to block common web attacks and gives clear visibility about what is happening. The managed rules are also useful, and it is good that we can still adjust things when needed. Review collected by and hosted on G2.com.

One thing I dislike is that sometimes the setup and tuning can feel a bit complicated, especially in the start. Some alerts or rules need extra checking to avoid false positives, and it can take time to understand why something was blocked. The interface is good overall, but few parts could be more simple and easier to follow. Review collected by and hosted on G2.com.

What I like most about Check Point WAF is its clear visibility into web traffic and blocked requests. It makes it easy to identify suspicious activity and fine-tune security policies. Once configured, it provides reliable protection with minimal day-to-day effort. Review collected by and hosted on G2.com.

The biggest drawback is the learning curve, especially for first-time users. The interface can feel crowded, and fine-tuning policiesThe initial setup and policy tuning can be time-consuming, especially if you're new to WAFs. The interface isn't always intuitive, and some configuration options require extra effort to understand. takes time to avoid false positives. Some configuration tasks could also be more intuitive. Review collected by and hosted on G2.com.

I use Check Point WAF to protect web applications and APIs from a wide range of cyber threats like SQL injection and cross-site scripting (XSS). What I like most about Check Point WAF is its ability to provide strong, automated protection for web applications while remaining easy to manage on a day-to-day basis. The platform effectively detects and blocks traffic. The initial setup of Check Point WAF was relatively straightforward, especially with the available documentation and guided configuration options. It provides strong protection against modern web application threats and offers good visibility through a centralized management interface. Review collected by and hosted on G2.com.

One challenge is the initial onboarding and policy tuning process. For organizations with complex or highly customized web applications, achieving the right balance between strong protection and minimizing false positives can require additional time and expertise. Review collected by and hosted on G2.com.

I find Check Point WAF very easy to use. Even if someone is new to firewall stuff, they can handle it effectively with some guidance on using its GUI. The setup is also quite straightforward; you can set it up in five to ten minutes using the GUI interface, which is quite comfortable for first-timers. Review collected by and hosted on G2.com.

As of now, I've used many firewalls, and while Check Point WAF's interface is good, I feel it could be improved a little bit. Compared to Fortinet, their GUI interface is slightly better than Check Point's. That's pretty much the only thing I would say needs improvement, although Check Point does have very good features compared to Palo Alto and ForteGate. Review collected by and hosted on G2.com.

I use Check Point WAF to protect our internet-facing web application and APIs from web-based threats like SQL injection and cross-domain issues. The solution provides advanced threat prevention and automated policy cleaning. I appreciate the traffic inspection and reverse migration capabilities that ensure application availability and maintain security compliance. It supports both community and hybrid environments. We also integrate it with our broader security ecosystem, which helps in monitoring and provides better visibility for threat detection. Cloud integration capabilities have simplified development, providing better visibility to application networks and stronger protection against top vulnerabilities. Review collected by and hosted on G2.com.

While Check Point WAF provides strong application security and configuration capabilities, there are some areas that could be improved. The initial set of policy tuning process can be complex for new administrators, requiring a good understanding of web application traffic patterns. The interface could be more user-friendly, and the reporting and dashboard customization options could be enhanced to provide more actionable insights. Additionally, licensing can be challenging for smaller organizations, I assume. Faster deployment templates for cloud-native applications would further simplify the implementation. Review collected by and hosted on G2.com.

Check Point WAF was mostly used for monitoring and securing internet-facing applications and APIs receiving traffic from outside clients. The majority of daily operations entailed examining rejected requests, analyzing security events post-deployment, and tuning protection rules in case legitimate traffic was impacted.

The main asset in terms of operational activities was insight provided at the HTTP and API level. This allowed for examination of request patterns, header details, path and URL parameters and, if needed, the actual contents of blocked requests, rather than looking at basic network data. It made things more clear whether strange behavior was caused by legitimate application operation, automated scanning, or attack attempts against available services.

Post-updates policy tuning was done occasionally because even minor front-end or API changes were affecting some protection settings. Review collected by and hosted on G2.com.

The tuning phase can be a lengthy one due to traffic fluctuations or custom APIs. Initially, I had to spend quite some time ensuring that blocked calls were indeed malicious or a result of the application's normal activity misinterpreted as something else.

Additionally, there is a need for constant tuning when dealing with multiple applications as well as keeping a balance between tight protection and not interrupting the production traffic.

Only after acquiring a good understanding of how signature definitions, exceptions, and policies worked internally did troubleshooting become easier. Review collected by and hosted on G2.com.

Strong protection against OWASP Top 10 attacks

Easy integration with cloud environments

Good real-time threat prevention and bot protection

Centralized management and visibility

AI-driven threat intelligence from Check Point

Scalable for enterprise workloads

Helpful automation and policy tuning feature Review collected by and hosted on G2.com.

Initial setup can be complex

Can be expensive for smaller companies

Some advanced configurations require expertise

Dashboard/UI can feel overwhelming at first

Occasional false positives that need tuning

Support response time may vary depending on the plan Review collected by and hosted on G2.com.