I like that Fortinet Managed Rules for AWS WAF automatically protect web applications from common cyber threats like OWASP Top 10 exploits, bots, and zero-day vulnerabilities, which saves our security team time. The hands-off threat intelligence updates from FortiGuard Labs are a big plus, and I love how it integrates effortlessly into AWS. Additionally, I find the FortiGuard OWASP Top 10 Rule Set particularly valuable because it automatically blocks major web exploits like SQL injection and XSS without requiring custom configuration. The initial setup was also very intuitive, making it easy to get started. Review collected by and hosted on G2.com.

The main area for improvement is the lack of detailed visibility and customization for individual rules, which can make diagnosing false positives quite challenging. The biggest challenge is handling false positives due to limited customization options, making it hard to fine-tune individual rules without disabling an entire ruleset. Review collected by and hosted on G2.com.

I like how Fortinet Managed Rules for AWS WAF solves the "security tax," drastically reducing the time, stress, and specialized skills required to protect web applications. The built-in bot control and traffic filtering features are particularly valuable, ensuring effective mitigation against known CVEs. Additionally, once the rules are added, they immediately begin inspecting traffic through ALBs, Amazon CloudFront distributions, or API Gateways, which streamlines the initial setup process and enhances security efficiency. Review collected by and hosted on G2.com.

I find the lack of granular rule customization challenging with Fortinet Managed Rules for AWS WAF. Inside AWS WAF, the partner-managed rules are largely 'all-or-nothing,' which means I can't tweak a specific signature’s parameters or adjust its strictness thresholds. This limits the ability to tailor the rules precisely to our needs. Review collected by and hosted on G2.com.

I like how I can manage all the rules by a single platform, and how easy it is to set up and integrate those rules with the AWS WAF. The unified management flow makes it simpler to have the rules across different platforms, such as AWS and the Fortinet FortiGate platform. The initial setup was pretty easy, with only a couple of steps to follow, which made the rest of the setup much easier. Review collected by and hosted on G2.com.

I think the integration could be more seamless and the setup process less complicated. It would be better if managing the rules was made easier, avoiding any complex configurations. An integration of AI would also be beneficial to understand how a particular rule is performing, whether it's efficient, and what specific traffic it's blocking. Adding these insights could improve the overall functionality of the platform. Review collected by and hosted on G2.com.

1.Fast to deploy — subscribe on Marketplace, attach to the existing web ACL, running same day

2.No rule writing or tuning required to get OWASP Top 10 coverage FortiGuard Labs handles signature updates, so we're not chasing new CVEs

3.Stays native to AWS — same console, CloudWatch metrics, sampled logs, Terraform workflow

4.Rule groups are separable (OWASP, SQLi/XSS, bots, API), so we only pay for what we use

5.COUNT mode let us validate against real traffic before blocking Strong coverage-to-effort ratio for a small team with no dedicated WAF engineer Review collected by and hosted on G2.com.

1.False positives on legitimate traffic (file uploads, rich-text fields, complex query strings) take trial and error to isolate

2.Documentation is lighter than Fortinet's on-prem WAF products; limited guidance on which rule group to pick for a given workload Review collected by and hosted on G2.com.

The biggest advantage is the combination of strong security coverage and ease of management. The preconfigured rules make it much easier to protect AWS workloads against common threats such as SQL injection, XSS, and known exploits without having to build and maintain everything from scratch. The integration with AWS WAF is straightforward, and the managed updates help keep protection aligned with new threats. Overall, it saves time while providing an additional layer of security for web applications and APIs. Review collected by and hosted on G2.com.

The main downside is that the rules can sometimes require tuning to avoid false positives, especially for applications with custom traffic patterns. It would also be helpful to have more detailed documentation and clearer guidance for fine-tuning rules for specific workloads. Pricing can also become a consideration as the number of protected resources grows. Review collected by and hosted on G2.com.

The main reason we use Fortinet's managed rules is how easily they plug into our existing AWS setup to cover core security risks like SQL injection and cross-site scripting. Building and updating custom WAF rules by hand takes way too much time, so having Fortinet's team handle the threat intelligence and signature updates behind the scenes saves a massive headache. It gives our public-facing APIs a solid baseline defense right out of the box without forcing us to spend hours tweaking custom logic every time a new vulnerability drops. Review collected by and hosted on G2.com.

The biggest issue is dealing with false positives when you first turn the rules on. If you jump straight to blocking mode, legitimate traffic or unusual API payloads will definitely get caught and blocked. You end up having to run everything in Count mode for a while, dig through CloudWatch logs, and set up override rules to fix the false alarms before you can actually enforce blocks. Another downside is the lack of visibility into the actual underlying rule logic. Because the signatures are proprietary black boxes, troubleshooting why a specific request got flagged takes more time than it should. On top of that, cost can accumulate quickly if you are running these rules across high-traffic Application Load Balancers, since AWS charges for rule evaluations alongside the subscription cost. Review collected by and hosted on G2.com.

The automated threat intelligence powered by FortiGuard Labs is the biggest win for our team. We use the Fortinet OWASP Top 10 and Known Bad Inputs/Bots Rulesets on our public-facing ALBs. Instead of constantly monitoring new CVEs and manually writing complex regex rules in-house, the rule sets are updated automatically in the background. It effectively neutralizes SQLi, XSS, and automated vulnerability scanner probes without adding latency to our applications. Review collected by and hosted on G2.com.

While the protection is robust, diagnosing occasional false positives can be challenging due to the 'black-box' nature of managed rules. When a legitimate multi-step API request containing complex JSON payloads gets blocked, AWS WAF logs show the rule group and rule ID, but not the exact string or parameter that triggered the match. We have to spend extra time cross-referencing logs and writing custom label-based exception rules. It would be a huge improvement if Fortinet/AWS could provide more granular trigger explanations or context directly in the logs to speed up root-cause analysis. Review collected by and hosted on G2.com.

I like Fortinet Managed Rules for AWS WAF because of its easy setup and the ready-made security rules that provide reliable protection against common web attacks like SQL injection and XSS. The consistent protection and easy rule management are great, as they reduce the need for manual security configuration. I particularly value the OWASP protection because it's easy to manage and reduces manual configuration. Overall, the initial setup was fairly easy and straightforward, requiring just a little configuration. Review collected by and hosted on G2.com.

The pricing could be more affordable, and the configuration could be simpler for new users. A simpler setup wizard, clearer step-by-step guidance, and recommended default rules would make configuration easier for new users. Review collected by and hosted on G2.com.

What I like best about Fortinet Managed Rules for AWS WAF is how easy it is to strengthen application security without having to build and maintain every rule manually. The managed rules provide broad coverage against common web application threats, are regularly updated to address emerging vulnerabilities, and integrate smoothly with AWS WAF. This saves time for security teams while providing reliable protection and reducing the effort required for ongoing rule management. Review collected by and hosted on G2.com.

One area that could be improved is the cost, especially for larger environments with multiple applications and AWS accounts. Some rules may also require tuning to reduce false positives and fit specific application requirements. More detailed documentation, clearer rule explanations, and easier troubleshooting would make it simpler to fine-tune the rules and understand why specific requests are being blocked. Review collected by and hosted on G2.com.

I like the straightforward AWS WAF integration, the broad OWASP and vulnerability coverage, and the automatic rule updates. It cuts down the effort of manually creating and maintaining security rules, while still providing solid protection for web applications and APIs. Review collected by and hosted on G2.com.

Some rules may need fine-tuning to cut down on false positives, and troubleshooting blocked requests would be more straightforward with improved visibility and clearer diagnostics. Review collected by and hosted on G2.com.