New Waiting Room Solution Ensures Best Peak User Experience

New Imperva Waiting Room Enables Organizations to Deliver Consistent Optimal Website User Experiences During Peak Traffic Periods Organizations benchmark website success by the volume of legitimate traffic and online sales it generates. Website architects want to drive as many visitors as possibl...

Why Customers Asked us for a Data Security Fabric (Even When They Didn’t Know to ask for it by Name)

Our journey to the data security fabric started a while back when we built the industry’s first data security platform based on what customers said they needed and working with customers as design partners. The concept of a software platform has been around for a long time. Like all platforms, we...

Imperva Ships API Security Providing Continuous API Discovery and Data Classification with Two Deployment Models

Every day, organizations are challenged to bring products to market faster and out innovate their competition. At the heart of many digital transformation initiatives are development teams looking for ways to achieve initiatives and deliver on new product goals. Many of these teams openly embrace...

What is Shift-Left Testing and What are the Benefits?

Back in the infancy of software creation, certainly up until the mid-90s when we still used more traditional software development practices, most testing was conducted at the end of the production cycle on a graph, this would be to the right on the development timeline. Shift-left takes this...

Why Now Is the Time to Jump into Cybersecurity and Join Imperva

Throughout history, periods of disruption are followed by eras of progress and transformation. While we are living through an unprecedented time, I believe we are on the cusp of another chapter of innovation — and I expect cybersecurity will be at the center of it. Cybersecurity Awareness Month, ...

Imperva Cloud Data Security adds Azure SQL support to build on extensive DBaaS coverage

It’s kind of mind boggling to see just how fast the market is adopting cloud managed database services also referred to as DBaaS. According to market research firm Imarc Group, In 2020, the overall market size was $12.8 billion, and within five years it’s expected to reach over $31 billion. That’...

From Layers to Microunits

The evolution of “Code Cohesion” and “Separation of Concerns” The software industry has recognized the values of “Separation of Concerns” and “Code Cohesion” for more than two decades. Many articles, books and software-thinkers have contributed methodologies to implement these important values. I...

Cloud Database Migration Peer Insights [Study]

Not long ago, for security, compliance or other reasons, it was unthinkable for many regulated organizations to move sensitive data into the cloud. It’s striking how things have changed. Maybe it was inevitable that services like email were cloud migration candidates. People trust Microsoft, and...

Protect Against WannaCry with Deception-Based Ransomware Detection

The WannaCry ransomware attack caught the world off guard—and may have even literally left some crying. The attack infected more than 230,000 computers in 150 countries by encrypting data on networked machines and demanding payments in Bitcoin. According to Malwarebytes researchers, the attack...

Imperva Customers Protected Against CVE-2026-9082 in Drupal Core

TL;DR:CVE-2026-9082 is a highly critical SQL injection vulnerability in Drupal core that can be exploited by unauthenticated users against Drupal sites using PostgreSQL. The vulnerability affects Drupal’s database abstraction API and can allow specially crafted requests to trigger arbitrary SQL...

API Security Operations: How to Move from Visibility to Measurable Risk Reduction

A five-level operating model for turning API security visibility into measurable risk reduction, faster remediation, and confident digital growth — without slowing development. What is API security operationalization? API security operationalization is the process of converting API discovery and...

N8N: Shared Credentials and Account Takeover

Executive Summary We identified a security weakness in n8n’s credential management layer that could have completely compromised the application’s security. This finding highlights the core risks of centralized authentication in workflow automation platforms. As n8n serves as the central hub...

Hacking Microsoft and Wix with Keyboard Shortcuts

Browser vendors continuously tweak and refine browser functionalities to improve security. Implementing same-site cookies is a prime example of vendors’ efforts to mitigate Cross-Site Request Forgery CSRF attacks. However, not all security measures are foolproof. In their quest to combat Cross-Si...

Imperva & Thales: Pioneering a New Era in Cybersecurity

Imperva has been a beacon of excellence for over twenty years in the digital protection landscape, where innovation is paramount. Renowned for its groundbreaking products, Imperva has not just secured applications, APIs, and data for the worlds leading organizations but has done so with incredibl...

DDoS Attacks Leveraged by Attackers in Israel Conflict

Over the last few years, we’ve observed Distributed Denial of Service DDoS attacks used in many conflicts. In the Russia-Ukraine war, DDoS was used both by government cyber agencies and individual hacktivist groups to disrupt the flow of information and deface sites to promote propaganda. The...

Misconfigurations of Cloud-Managed Infrastructures Continue to be a Major Challenge to Data Security

In case you missed the memo, cloud-hosted data is here to stay. Recent data shows spending on cloud services reached a total of $178 billion in 2021, a 37 percent increase over the $130 billion spent in 2020 and twice the amount enterprises are spending on their data centers. As more organization...

Imperva Data Security Fabric Wins 2022 SC Media Trust Award for Data Security

SC Media has announced the winners of their 2022 SC Awards, with 38 companies, executives, and security solutions selected by their panel of judges as the best of the year. We are thrilled to report that ​Imperva Data Security Fabric has earned the 2022 SC Media Trust Award for Data Security. For...

API Security is Necessary to Stop Threats that WAFs and Bot Protection Cannot

Today, there are still API security threats that most WAFs and Advanced Bot Protection solutions cannot manage. In this post, we’ll explain these new types of threats and make some recommendations for features you need within solutions to protect your APIs. When a bad actor makes a completely val...

New reforms will enhance the security and resilience of Australia’s critical infrastructure

Improving the security of critical infrastructure has become the focus of many governments around the world, including Australia. This is because a failure or disruption in one area of critical infrastructure can have flow on effects that affect a nation’s security, economy and sovereignty. In th...

Wake up and smell the Javascript – website supply chain puts online retail at risk

There are more than 1.8 billion websites online today, and almost 98% of them are powered by JavaScript. There’s a good reason for this: JavaScript’s flexibility and portability enable the rich online functionality we’ve all come to know and love. But what happens when that same functionality...

Your inbox is mine. How attackers could gain continuous access to your email

Although new messaging apps like WhatsApp, Telegram, and Messenger have taken a large chunk of our day to day communications, email remains one of the most popular ways we communicate. In this post we’ll talk about the post exploitation of a vulnerability we recently disclosed to one of the most...

Caveat Cyber Emptor: 3 Ways to Protect Sensitive Personal Data this Online Shopping Season

The phrase caveat emptor, Latin for “let the buyer beware”, has long been a warning to carefully scrutinize the quality and suitability of goods before making a purchase. In the world of eCommerce, caveat emptor has a whole new meaning. After meticulously researching any number of crowdsourcing...

Data security is broken: What’s next?

One out of every two on-premises databases globally has at least one vulnerability, finds a new study from Imperva Research Labs spanning 27,000 on-prem databases, based on insights from a proprietary database scanning service introduced by Imperva Innovation five years ago. The question is: why ...

Web Application Attacks on Healthcare Spike 51% As COVID-19 Vaccines are Introduced

As the first vials of COVID-19 vaccines were disseminated in December, Imperva Research Labs monitored an astounding 51% increase in web application attacks on healthcare targets. The activity concludes an unprecedented year of cybersecurity activity. Imperva data shows the healthcare industry...

Good Bots In. Bad Bots Out.

More than half of Internet traffic today comes from bots. These non-human visitors crawl the web constantly, their numbers are increasing, and they are getting smarter and more human-like by the minute. Imperva has been tracking these trends for more than five years, in an ongoing statistical stu...

Are All Ransom Attacks Considered Ransomware?

Ransomware has loomed large in the news of late. It seems to be around every turn, and it’s not going anywhere. The untraceability of Bitcoin payments, coupled with new blackhat tools available to anyone at little if any cost, means extortion attempts will continue to grab headlines worldwide. Bu...

API Security Demystified: Which Tools Actually Protect Your APIs (And Where the Gaps Are)

Introduction Quick answer: No single tool secures an API. API security is a layered discipline. Secure-coding analyzers and SCA scanners catch code and dependency flaws; DAST tests running APIs; API gateways and IAM enforce authentication and rate limits; a WAF blocks known attack patterns; bot...

Why AI Agents Make API Security a CISO Priority

AI agents are not a future concern. They are already changing how enterprise systems are accessed, automated, and abused. And the security implication is clear: the more autonomous systems rely on APIs, the more important it becomes to know exactly which APIs exist, how they are being used, and...

Another Critical RCE Discovered in a Popular MCP Server

Artificial Intelligence development is moving faster than secure coding practices, and attackers are taking notice. Imperva Threat Research recently uncovered and disclosed a critical Remote Code Execution RCE vulnerability CVE-2025-53967 in the Framelink Figma MCP Server. This is just one exampl...

MadeYouReset: Turning HTTP/2 Server Against Itself

Introduction HTTP/2 was designed for performance- faster multiplexed connections, stream prioritization, and header compression. But these same features have also opened the door for sophisticated denial-of-service attacks. Back in 2023, the HTTP/2 Rapid Reset vulnerability made headlines after...

Agentless is a DAM Better Option for Securing Cloud Data

When it comes to on-premises database activity monitoring DAM, security teams have consistently relied on agents to seamlessly track all incoming requests and outgoing responses within the databases. The agent-based approach effectively ensures independent monitoring of database activity,...

Why Imperva is a Cybersecurity Awareness Month Champion

This is our second consecutive year as a champion of Cybersecurity Awareness Month. Nowadays, IT security is everyone’s responsibility, and that’s something we take very seriously. Cybersecurity Awareness Month raises awareness of the core principles behind cybersecurity and highlights the key...

SaaS Eliminates Barriers to Applying Security Controls to Your Entire AWS and Azure Data Repository

Businesses today widely regard data as “the new oil,” the most valuable resource on earth. At the same time, we are in the midst of the most dynamic IT landscape in history which is increasing the risk to this most valuable asset. Organizations, without sufficiently skilled staff to effectively...

Imperva Reaches New Heights as it Opens PoPs in Cape Town and Rio

Imperva is reaching new heights as we expand our global network of data centers with new points of presence PoPs in Rio de Janeiro, Brazil and Cape Town, South Africa. The two cities, often compared to each other for their many similarities including their breathtaking coastlines, white sandy...

Four Reasons why you Should Consider Contingency DDoS Protection

The experts agree that Imperva is solidly positioned as a leader in Distributed Denial of Service DDoS mitigation. Over our many years as leaders in this space, we have determined that no matter how reliable your current DDoS protection is, there is always a chance that your network infrastructur...

How to do Feature Selection Using Feature Contribution Data

Feature contribution is a method to give a weight to each feature that reflects its impact on the model’s prediction. Feature contribution can be calculated on an entire dataset or a single data point. In our previous blog post, we showed how to visualize feature contributions to make it easy to...

How the Evolution of Agents has Been Essential for Modern Database Security

In today’s data driven world, every organization’s most important asset is their data. Accordingly and similarly to other protected components like applications, web and peripheral gateways, databases require a dedicated security solution as well. An essential database security solution must...

What to Include in a Cybersecurity Disaster Recovery Plan

If the unthinkable were to happen to your business, what’s your disaster recovery plan? If bad actors were to inject ransomware into your system, what’s your process for a return to normal working? Google the words “What do I do if I have a cybersecurity breach” and the first twenty results will...

Scalpers, and their bot armies, swing in to net web-based Spiderman tickets

29 November 2021 was “Spider Monday” and tickets for Marvel’s film Spider-Man: No Way Home went on sale with the sort of marketing fervor for which Disney and the Marvel Cinematic Universe MCU are famous. As tickets to one of the most eagerly anticipated Christmas films featuring one of the most...

Fostering the Next Generation of Female Technologists at Imperva

Today marks the start of the 2021 Grace Hopper Celebration, the largest gathering of female technology leaders in the world. Last year, over 40,000 women from 117 different countries attended virtually, bringing together their research and career interests to help inform and inspire others. As...

What’s Different About Data Security in the Cloud? Almost Everything.

Well before the onset of the pandemic most organizations had a digital transformation plan in place which included migrating workloads to new modern architectures, usually a private, public, or hybrid cloud. As the challenges caused by COVID-19 became more acute, these organizations accelerated...

Security Strategies for DevOps, APIs, Containers and Microservices

More and more IT professionals see DevSecOps, a practice which integrates security measures earlier in the development process to improve production code quality, as a mainstay for future application development. Much of this stems from the growing trend towards speeding up application developmen...

Women in Tech and Career Spotlight: Inna Shalom

The latest in our series featuring women in tech at Imperva is my interview with Inna Shalom, the data insight team lead at Imperva. She spoke about her professional journey and experience working in the cybersecurity industry. Tell us how you got into cybersecurity. IS: I spent the first six yea...

The Forrester Wave Ranks Imperva as a Leader for DDoS Mitigation Providers

Imperva has tracked the DDoS threat for some time now. Back in 2014 we saw the rise of DDoS botnets. In 2015, we revealed one of the first IoT-based DDoS attacks. Last year, we predicted and then documented one of the largest botnet-based DDoS attacks. DDoS mitigation, as it turns out, is the...

Understanding the Capacity Management Challenges of Database Monitoring Solutions

Database monitoring requires hardware resources such as storage space and processing power that can withstand the volume of database usage in your organization. A higher usage volume will require more resources. So how can you optimize the resources used by your database monitoring solution? Do y...

OWASP LLM Top 10 2026: Every Move Points the Same Direction

This is Post 4 of a four-part series: Post 1: Agentic AI Security: The Chatbot Era Is Over Post 2: Generative AI Security: Why AI Needs a New Kind of Security Post 3: The OWASP LLM Top 10 Was the Warm-Up: What Comes Next The 2026 edition of the the OWASP Top 10 for LLM Applications, published by...

Integrating Advanced API Security with Imperva Gateway Environment

As APIs power the majority of modern web applications, implementing robust API security is no longer optional - it’s a critical necessity for data protection. This guide explores how to seamlessly integrate API gateway security into your Imperva on-premises environment to mitigate OWASP Top 10...

Paris, The Thinker, and why your WAF should block XSS by default

With Thales HQ in Paris, it felt right to detour to the Musée Rodin and stand before The Thinker, the bronze giant by Auguste Rodin whose clenched posture and chin-in-hand stance have become a universal symbol of deep judgment. Conceived for The Gates of Hell in 1880 and first cast monumentally i...

Imperva and the Secure by Design Pledge: A Commitment to Cybersecurity Excellence

The Cybersecurity and Infrastructure Security Agency CISA has introduced a voluntary "Secure by Design Pledge" for enterprise software manufacturers, focusing on improving the security of their products and services. This pledge outlines seven key principles, forming the core of a robust...

Meet Andy Zollo, SVP of APJ Sales

Andy Zollo, who led the Imperva business in EMEA, relocated to Singapore in October to be Senior Vice President of Sales for the combined Imperva and Thales CPL businesses in the APJ region. With a wealth of experience in sales leadership and business transformation, Andy is set to play a vital...