zcrWAF vs Cloudflare WAF vs AWS WAF vs Imperva: Which WAF Actually Fits a Thai Organization

Compare zcrWAF against Cloudflare WAF, AWS WAF, and Imperva on pricing, deployment, rule engines, and support — with a clear table to pick the right WAF.

zcrWAF vs Cloudflare WAF vs AWS WAF vs Imperva: Which WAF Actually Fits a Thai Organization

If you've been comparing WAF vendors for more than an afternoon, there's a good chance your spreadsheet has a pricing column you can't fill in — half the vendors route you straight to a "Contact Sales" page, and the other half publish numbers that are hard to compare because no two of them price the same way. That's the real problem when you're the one who has to pick a WAF for your organization — not just eyeballing feature lists on a website.

This article compares zcrWAF against three global players Thai IT teams keep putting on the same shortlist: Cloudflare WAF, AWS WAF, and Imperva Cloud WAF. We've relied on each vendor's own official documentation wherever it's available, flagged the few spots where we had to lean on a third-party estimate instead, and skipped guessed pricing or guessed features entirely — and we're going to say plainly where each competitor genuinely wins. A comparison article that hands every category to the same vendor reads like an ad, not something that actually helps you decide.

zcrWAF vs Cloudflare WAF vs AWS WAF vs Imperva — comparing deployment, pricing, and rule engines

What Is a WAF, and Why Can't a Business Website Skip It?

If you're not already familiar with WAFs (Web Application Firewalls), our What Is a WAF? article breaks it down in detail with real examples from the zcrWAF demo. The short version: a WAF sits in front of your web application and filters incoming traffic before it ever reaches your real server — catching things like SQL injection, cross-site scripting, bots scanning for vulnerabilities, or abnormal traffic patterns that look like an attempted flood.

For Thai organizations, this isn't a "nice to have" — it's closer to a requirement. Thailand's Website Security Standard is a benchmark that many government agencies and organizations subject to cybersecurity audits have to meet, and a WAF is one of the core controls it calls out.

What Is zcrWAF?

zcrWAF is a Web Application Firewall developed by a Thai team, built on the OWASP Core Rule Set (OWASP CRS) — an open, widely-adopted rule standard used across the industry, including in open-source projects like ModSecurity. It's not something zcrWAF owns exclusively; it's a stable, auditable foundation, in contrast to some competitors' closed engines where you have no visibility into how blocking decisions actually get made under the hood.

Three Deployment Options — Where zcrWAF Diverges Most Clearly From This Group

Per the official brochure (zcrWAF_Brochure_v1.5.1), zcrWAF ships in three real forms:

Cloud (SaaS) — no hardware required, built for small organizations
Virtual Appliance (VM) — deploys on-premise on infrastructure you already have, no extra hardware purchase, suited to small-to-mid-size organizations
Appliance (ICT Hardware) — deploys on-premise on standard ICT hardware, scaling from small organizations up to large ones

This matters a lot when you set it against Cloudflare and AWS WAF, because both of those are cloud/edge-only — neither offers a way to run inspection on your own network at all. If your organization has a genuine requirement to keep data inside your own network, Cloudflare and AWS WAF simply can't meet that, by design. The narrower question of keeping data inside Thailand's borders is a bit more nuanced — see the AWS WAF section below.

Core Features Confirmed Directly From the Live Demo

We logged into the actual live demo (login details are at the end of this article), and here's what's real and functional:

OWASP Top 10 protection — SQL Injection, XSS, Path Traversal, Remote Command Execution, Remote File Inclusion, PHP Injection, Session Fixation, and Protocol Violation, all visible as real attack-category filters. For a deeper look, see How zcrWAF Protects Against the OWASP Top 10, which walks through how these attack types show up in the Attack Logs.
Bot and DDoS protection via rate limiting, CAPTCHA challenges, and dedicated "Scanner/Bot" and "Bot Mitigation" categories in the Protection Logs screen — see real Rate Limiting configuration examples in zcrWAF's Bot and DDoS Protection.
Multi-tenant support — separates policies and security data per tenant, with each tenant able to run its own rule set.
Granular RBAC — access control broken down by feature (Security Dashboard / Alerts & Monitoring / Protection Rules / Applications & Network), confirmed live in the demo's Users Management screen.
Custom rule builder — define a rule name, priority, rule type (e.g., DENY/Blocklist), status, expiry, and conditions.
Real-time monitoring dashboard — a live QPS counter and traffic-trend graph, with a running total of requests seen, allowed, and blocked, plus a breakdown of top attacking source IPs by country. The dashboard runs on the demo's own sample traffic, so treat it as a demonstration of what the screen tracks, not a benchmark of what any organization would see.
Searchable Protection Logs, filterable by severity, action, time range, custom date range, source IP, status code, and attack category.
Per-site protection or observation (monitor-only) mode, so you can watch before you enforce.

On the performance side, the only real, published figure right now is that the ICT Appliance supports 1 Gbps GbE throughput. There's no separate requests-per-second figure or added-latency benchmark published. If your organization needs more detailed load-test numbers to compare against competitors, the better move is to request a spec scoped to your actual traffic volume directly — which is something the zcrWAF team can advise on based on real usage, rather than handing you one standard number meant to apply to everyone.

Cloudflare WAF — The Biggest Network, a Real Free Tier, No On-Prem Option

Cloudflare has the clearest scale advantage in this group. Its network spans 330+ cities across 125+ countries, with over 500 Tbps of total capacity — a milestone Cloudflare announced in April 2026, distinct from its DDoS attack-mitigation stats. On the attack side, Cloudflare's Q4 2025 DDoS report cites two separate records from around the same period: a standalone 31.4 Tbps attack that lasted just 35 seconds, and, from a separate December campaign, a peak of roughly 205 million requests per second — two different events, not one attack that hit both marks at once. Either way, both figures describe overall network scale, not a WAF-specific latency benchmark, but they do reflect genuinely handling enormous traffic volumes.

Cloudflare's pricing is publicly published (sourced from multiple independent data aggregators whose figures agree with each other, since Cloudflare's actual pricing page renders via JavaScript):

Free — $0, uses the Cloudflare Free Managed Ruleset (a limited rule set, not the full OWASP CRS)
Pro — roughly $25/month billed monthly (~$20/month on annual billing), includes the full Cloudflare Managed Ruleset plus the real OWASP Core Ruleset
Business — roughly $250/month billed monthly (~$200/month on annual billing), includes up to 100 custom WAF rules, a 100% uptime SLA, and PCI/SOC 2 Type II support
Enterprise — custom quote only; some data aggregators estimate a starting point around $5,000/month, but that figure isn't officially confirmed

Worth knowing: pricing is per domain (per zone), and the real OWASP CRS is only available starting at the Pro tier and above — the Free tier only gets the thinner rule set.

Cloudflare's genuine strengths are the largest network in this group and being the only vendor here with a real self-serve free tier you can try without talking to anyone. Its limitation is that it's cloud/edge-only — there's no on-prem or appliance option at all. On Thai support: we found no Cloudflare office of its own in Thailand — it reaches the market through partners like KSC and ThaiPCSupport, and there's no evidence of direct Thai-language support from Cloudflare itself.

AWS WAF — Pay for What You Use, Tightly Coupled to the AWS Ecosystem, but AWS's "Core Rule Set" Isn't OWASP CRS

The single most common point of confusion when comparing AWS WAF to the others is the name "Core rule set (CRS)" in AWS's own product (AWSManagedRulesCommonRuleSet) — it sounds a lot like OWASP CRS, but it's actually a rule set AWS built entirely in-house, designed to cover categories aligned with the OWASP Top 10, but it isn't the actual open-source OWASP/ModSecurity CRS project that Cloudflare and zcrWAF use. AWS layers on several additional managed rule groups too — Known Bad Inputs, SQLi, Linux/Windows/PHP-specific sets, IP Reputation, Bot Control, and Account Takeover/Fraud Control.

Pricing is pay-as-you-go with clearly itemized components:

$5.00 per Web ACL/month
$1.00 per custom rule/month
$1.00 per added managed rule group/month
$0.60 per 1 million requests processed
Example: 1 million requests/month + 10 rules ≈ $15.60/month; 50 million requests + 20 rules + 2 managed groups ≈ $57/month

On deployment, AWS WAF works both at the edge (via CloudFront) and in a regional model (attached to ALB, API Gateway, AppSync, Cognito, and others). Notably, AWS opened its Asia Pacific (Thailand) Region in January 2025 — meaning workloads running on AWS resources in Thailand can have AWS WAF perform inspection in-country, without needing a separate appliance. That's a partial answer to keeping data inside Thailand's borders — it's not the same as running on your own internal network the way a physical appliance can.

Thai-language support tells a different story, though — AWS's standard support only covers Chinese, English, Japanese, and Korean. Thai isn't a supported language under AWS Support's standard tiers. Thai-language interaction is available through an Enterprise Support Technical Account Manager — a capability AWS's own Enterprise Support materials list, not a rigid documented guarantee — on a tier that carries a fairly substantial monthly cost (we haven't verified the exact figure in this research pass).

AWS WAF's real strength is how tightly it plugs into the rest of the AWS ecosystem — if your organization already runs everything on AWS, adding a WAF is nearly frictionless, without the DNS migration or separate onboarding steps that Cloudflare or Imperva require.

Imperva Cloud WAF — The Only One With a Genuine On-Prem Appliance, and Strong Analyst Recognition

Imperva is the interesting exception in this group — it's the only vendor besides zcrWAF with a real on-prem hardware option. The Imperva WAF Gateway comes as both a hardware appliance and a virtual appliance (supporting VMware, KVM, or deployment on AWS/Azure/GCP), built specifically for organizations with strict data-residency needs or air-gapped environments. Customers typically deploy and operate it themselves through their own console — though Imperva's own Thai-market messaging also promotes "Full Managed Services" delivered through certified local partners, so a locally-managed option does appear to exist there too; we couldn't independently verify the details of that program in this research pass, so check directly with Imperva or a Thai partner if that model interests you.

On pricing, Imperva is quote-only across the board, with no public pricing page. The $59/month (Pro) and $299/month (Business) figures you'll find on some review sites appear to date back to Imperva's earlier Incapsula-era pricing, before Imperva was acquired by Thales (deal closed December 2023) — they shouldn't be treated as current.

Imperva's rule engine is also proprietary, combining signature-based detection with dynamic profiling and ThreatRadar (a reputation database built from data across Imperva's global customer base). It covers OWASP Top 10 categories but isn't built on the actual OWASP CRS/ModSecurity engine either.

Its clearest, most verifiable strength is analyst recognition — Imperva was named a Leader in the Forrester Wave: WAF Solutions, Q1 2025, alongside Akamai and Cloudflare (meaning it shares Leader status with Cloudflare in the same evaluation, not something Imperva holds uniquely), and it has a multi-year track record as a Gartner Magic Quadrant Leader in WAAP. On Thai support, Imperva enters the market through distributor Exclusive Networks Thailand — the same channel as Cloudflare.

Comparison Table

	zcrWAF	Cloudflare WAF	AWS WAF	Imperva Cloud WAF
Deployment	Cloud, Virtual Appliance, ICT Hardware Appliance (3 options)	Cloud/Edge only	Cloud/Edge + Regional (tied to AWS services, now with a Thailand Region)	Cloud + on-prem/virtual Appliance
Real on-prem option	Yes	No	No	Yes
Pricing	Contact sales (all tiers)	Publicly published: Free / ~$25 / ~$250 / Enterprise custom quote	Pay-as-you-go ($5/Web ACL/mo + $1/rule + $0.60/million requests)	Contact sales (older public figures no longer reliable)
Rule engine	OWASP Core Rule Set (CRS)	Cloudflare Managed Ruleset + real OWASP CRS (Pro tier and up)	AWS's own rule set, named after OWASP categories but not actual OWASP CRS	Proprietary + ThreatRadar, not OWASP CRS
Free tier	No	Yes (limited rule set)	No (pay-as-you-go)	No
Published performance figure	ICT Appliance: 1 Gbps GbE (the only published number)	500 Tbps network capacity (network scale, not WAF latency)	Supports 100,000 rps per Web ACL (regional resources only)	13+ Tbps scrubbing network (network scale, not WAF latency)
Multi-tenant + granular RBAC	Yes (confirmed live in demo)	No comparable data found	No comparable data found	No comparable data found
Thai-language support	Through the channel partner; scope and response times are set in that partner's service agreement	Partner channel only	Not in standard tiers (requires Enterprise Support)	Distributor channel, plus a Managed Services program in Thailand
Standout strength	Real on-prem option + Thai-built + multi-tenant RBAC	Largest network + genuine free tier	Deep AWS ecosystem integration + now has a Thailand Region	Strong analyst recognition (Forrester/Gartner)

A quick caveat on this table: the performance figures aren't measured on the same basis. Cloudflare's and Imperva's Tbps numbers describe total network scale, not the latency a WAF adds per request, and AWS WAF's 100,000 rps figure is a limit specific to regional resources — none of these translate directly to zcrWAF's appliance-level throughput number. There's no single benchmark right now that measures all four vendors on the same standard. If you need numbers that map to your actual workload, the most reliable path is running a PoC directly with the vendor you're considering.

Want to talk through the spec or pricing that actually fits your organization's size?

Contact the zcr team →

So Which Organization Should Choose What?

Honestly, there's no single right answer for every organization.

If you already run everything on AWS, have no in-country data-residency requirement, and want pay-as-you-go flexibility, AWS WAF is a solid fit — especially for workloads you want to run through the Thailand Region (open since January 2025).

If your organization manages multiple domains, wants the largest edge network on the market, and would rather try something free before committing, Cloudflare WAF is a reasonable pick — just know you'll need to upgrade to Pro or above to get the real OWASP CRS.

If you're a financial institution, government agency, or business that needs a physical appliance sitting inside your own network, Imperva brings solid analyst credibility to back that choice — self-managed, or through the locally-managed option Imperva's Thai-market messaging promotes (confirm the actual scope of that program directly with Imperva or a partner).

zcrWAF, meanwhile, fits Thai organizations that want a genuine on-prem option without taking on all the operational overhead themselves (support scope and response times are set in the channel partner's service agreement), organizations that need a WAF among the controls Thailand's Website Security Standard calls out, or organizations juggling multiple websites or business units under one company, where multi-tenant support and granular RBAC make it easy to keep each unit's permissions and security policy cleanly separated.

To be upfront about the trade-off: zcrWAF doesn't yet have the kind of detailed performance benchmarks the global players publish (though in fairness, none of the three actually publish a WAF-specific latency benchmark either — only overall network-scale numbers), and there's no self-serve free tier like Cloudflare's to test-drive. If you want to try before deciding, your best bet is the live demo below, or reaching out directly for a PoC.

Try the zcrWAF Demo

The zcrWAF demo is at https://demo.waf.zcr.ai/login — unlike most other zcr product demos, this one requires login rather than being open to browse freely. Use the account demo.admin / password demo123 to access the Protection Logs, real-time dashboard, and custom rule builder screens described throughout this article.

Frequently Asked Questions

What deployment options does zcrWAF offer? Cloud/SaaS, Virtual Appliance, and ICT Appliance for on-premise deployment — pick based on your organization's size and infrastructure requirements.

How much does zcrWAF cost? Pricing is based on deployment size, contract term, and support level needed. Ask a channel partner of zcr.ai for a quote scoped to your actual requirements.

What does zcrWAF protect against? OWASP Top 10 coverage, rate limiting, bot and automated-traffic protection, CAPTCHA challenges, real-time monitoring, and searchable logs.

How is zcrWAF different from Cloudflare, AWS WAF, and Imperva? The clearest difference is that zcrWAF offers a genuine on-prem hardware appliance option (Cloudflare and AWS WAF are cloud/edge-only and can't deploy on-prem at all).

Conclusion

No single WAF wins on every front. zcrWAF fits Thai organizations that want genuine on-prem deployment — without the full self-management burden Imperva's default model asks for, and without the coverage gaps Cloudflare and AWS WAF have outside their own cloud/edge footprint.

If you're still not sure, the fastest path forward is talking to a team that understands both sides — what zcrWAF genuinely delivers, and the limitations worth knowing before you decide.

Contact the zcr team Email: hello@cyberdefense.co.th Phone: 086-940-1383, 082-037-0611 LINE: @cyberdefense

Sources

Cloudflare — 500 Tbps of capacity announcement, accessed 2026-09-15.
Cloudflare DDoS Threat Report, Q4 2025, accessed 2026-09-15.
Cloudflare — WAF plans and pricing, accessed 2026-09-15.
AWS — WAF managed rule groups list (AWSManagedRulesCommonRuleSet), accessed 2026-09-15.
AWS — WAF pricing, accessed 2026-09-15.
AWS — Asia Pacific (Thailand) Region launch announcement, accessed 2026-09-15.
AWS — Enterprise Support plan (Technical Account Manager languages), accessed 2026-09-15.
AWS — WAF service quotas (100,000 rps per Web ACL), accessed 2026-09-15.
Imperva — named a Leader in the Forrester Wave: WAF Solutions, Q1 2025, accessed 2026-09-15.
Imperva — Gartner Magic Quadrant Leader track record for WAAP, accessed 2026-09-15.
Thales — completes acquisition of Imperva, accessed 2026-09-15.
Imperva — DDoS Protection for Networks datasheet (13+ Tbps scrubbing capacity), accessed 2026-09-15.
Exclusive Networks Thailand — Imperva vendor page, accessed 2026-09-15.
PKF Thailand — Thailand's Website Security Standards 1.0: A Comprehensive Guide, accessed 2026-09-25. Summary of the NCSA standard; states that it calls for firewalls and web application firewalls among its protective measures.