In short: Check Point CloudGuard WAF, now listed simply as Check Point WAF, protects web applications and APIs using machine learning rather than signatures. We supply it as WAF as a Service, a managed reverse proxy in Check Point's cloud, in Advance Enterprise or Premium Enterprise plans, billed monthly through Forever Systems.
What Check Point WAF is
A web application firewall (WAF) protects websites, customer portals and APIs from attacks that a network firewall does not see, such as injection, cross-site scripting and automated abuse. Check Point's product was launched as CloudGuard AppSec, became CloudGuard WAF and is now listed on Check Point's site as Check Point WAF, within its Hybrid Mesh Network Security pillar.
Its distinguishing approach is machine learning instead of signatures. Check Point describes two engines: one trained on known attack indicators, and one that learns each application's normal behaviour so it can spot requests that do not fit. The aim is protection against the OWASP Top 10 without constant rule tuning or signature updates. For the wider picture of protecting cloud workloads, see cloud firewall on our cloud security site.
What it protects
| Capability | What it covers |
|---|---|
| Web application protection | OWASP Top 10 attacks such as injection and cross-site scripting, using contextual machine learning |
| API security | API discovery, change monitoring and schema validation enforcement |
| Bot prevention | Detection and blocking of automated abuse |
| DDoS protection | Layer 3/4 and layer 7 attacks, handled at Check Point's points of presence in the SaaS model |
| File security | Scanning of files uploaded to your applications |
| GenAI protection | Protection for applications that expose generative AI features, against threats such as prompt injection and data leakage |
It is managed in the Check Point Portal, the same console as Check Point's workspace products.
WAF as a Service and how it works
We supply Check Point WAF as WAF as a Service (WAF SaaS). It works as a reverse proxy: you change DNS for the protected domain so traffic flows through Check Point's global points of presence, where TLS is terminated, traffic is inspected and DDoS and bot mitigation is applied, before legitimate requests are forwarded to your servers.
- Check Point runs the points of presence, TLS termination, issuing and renewing certificates, DDoS and bot mitigation and the WAF inspection.
- You control DNS for the domain, make your servers reachable from Check Point's points of presence, and lock them down so they cannot be reached directly from the internet.
- Data region: configuration and logs are stored in a region you choose; Check Point's documentation lists EU, US, India, Australia and Canada, so UK organisations normally use the EU region. The region is chosen when the account is created.
Check Point also offers self-hosted deployment options, such as virtual machines and containers in your own cloud or data centre. If you need one of those instead, ask us and we will confirm the licensing.
How it is licensed
Through Forever Systems, WAF as a Service is licensed as a plan for your tenant, in two levels:
| Plan | Typical fit |
|---|---|
| SaaS WAF Advance Enterprise | Core web application and API protection for your sites |
| SaaS WAF Premium Enterprise | The higher plan, with a broader feature set than Advance |
What each plan includes, such as the number of protected assets and traffic allowances, is confirmed on your quote, because it depends on how many sites and APIs you protect and how busy they are. The plan is billed monthly in your Check Point Portal tenant. Ask us for a quote with a list of the domains and applications you want to protect.
Who it suits and how we help
Check Point WAF suits organisations running customer-facing websites, portals, e-commerce or public APIs, particularly in AWS, Azure or Google Cloud, and those that want WAF protection without managing rule sets day to day. It also fits organisations already using Check Point for endpoint or email, because it uses the same portal.
We list your applications, recommend a plan, onboard each domain in learning mode, agree when to move to prevention, and handle certificate and DNS changes with you. Ask us for a quote, or compare network protection options on our firewalls and network security page.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is CloudGuard WAF the same as Check Point WAF?
Yes. CloudGuard AppSec became CloudGuard WAF, and Check Point's website now lists it as Check Point WAF. The product and documentation still use the CloudGuard name in places.
How does WAF as a Service work?
It is a reverse proxy in Check Point's cloud. You point your domain's DNS at Check Point's points of presence, which terminate TLS, inspect and filter traffic, and forward legitimate requests to your servers.
Where is Check Point WAF data stored?
Configuration and logs are kept in a data region you choose. Check Point's documentation lists EU, US, India, Australia and Canada; UK organisations normally use the EU region.
How is Check Point WAF licensed?
Through Forever Systems, WAF as a Service is licensed as an Advance Enterprise or Premium Enterprise plan for your tenant, billed monthly. We confirm the assets and traffic each plan covers on your quote.