Companies Using Imperva

I'm David Thomson, CTO at TechnologyChecker.io. I've spent fifteen years building crawling and detection infrastructure, five of them on Google's Search team working on large-scale crawling and indexing. This analysis covers 28,846 active Imperva domains from our August 2026 crawl, 17,028 of which matched to a company record. Imperva is one of the more dependable technologies in our index, for a reason worth stating up front: it identifies itself in the HTTP response headers of every site it fronts, so detection never depends on a script executing or a consent banner being accepted. Across the domains where Imperva is present, we detect it on effectively every scan.

Growth trajectory

Imperva sat on 26,640 domains in June 2026 and 28,846 in August. I would not read an annual growth rate into three months, and I would rather say so than draw a longer line than the measurement supports. What the figure does settle is scale: Imperva holds 12.01% of WAF & DDoS Protection, third behind Sucuri (38.49%) and DDoS-Guard (37.79%). Those two protect enormous volumes of small sites. Imperva's footprint is roughly a third of theirs by domain and worth a great deal more per domain, which is the first thing to understand about this category.

"Counting domains puts Imperva third in its category. Counting the companies behind those domains puts it first. In WAF, the leaderboard you choose decides the answer you get." - David Thomson, CTO at TechnologyChecker.io

Sales Signal: Do not size this market on domain count. The addressable value sits in the 12.17% of Imperva accounts with over 1,000 staff, roughly 1,900 enriched companies, and those are the accounts already paying for edge security rather than evaluating whether they need it.

Customer profile

The size distribution is genuinely bimodal, and that is the most useful thing on this page. 58.11% of enriched Imperva companies have fewer than 50 employees, a long tail inherited from the self-serve cloud tier that began life as Incapsula, founded in 2009 by Gur Shatz and Marc Gaffan and folded fully into Imperva in 2014. Yet 12.17% employ more than 1,000 people and 3.17% are over 10,000. The age data splits the same way: 22.75% were founded in the 2010s while 18.70% predate 1960. Imperva sells to digital-native businesses and to institutions older than the web, and almost nothing about the two groups is alike.

Checking the fifty largest deployments directly, we confirmed live Imperva headers on nineteen of twenty sampled, including PepsiCo, Vodafone, Banco Santander, United Airlines, Thales, Baker Hughes and Johnson Controls. Ten of the fifty returned a 403 to an automated request, which is the product doing precisely what it was bought to do.

Sales Signal: Treat these as two lists, not one. The sub-50-staff segment buys self-serve and churns on price. The 1,000-plus segment buys through procurement, renews on multi-year terms, and is where migration services and compliance tooling actually sell.

Industry and geographic concentration

No single industry exceeds 7%, so Imperva is horizontal infrastructure. Cluster the regulated verticals, though, and the picture sharpens: insurance (6.92%), financial services (5.54%) and banking (2.67%) reach 15.13% combined, the clearest vertical signal in the data. Geographically the base is less US-centred than most enterprise software we track, at 42.87% United States against 10.22% United Kingdom and 5.37% Australia. Spain at 3.73% ranks ahead of both France and Germany, carried by Santander, Asisa and a cluster of Spanish-language properties across Latin America.

Sales Signal: The regulated-finance cluster is the warmest segment on this page, because PCI DSS and DORA make a WAF a compliance line item rather than a discretionary purchase. Spain and Latin America look under-served relative to their share and are worth a localized motion.

Migration patterns

One corridor dominates, and it runs to a technology that is not even in this category. Over the last 30 days 219 domains left Imperva for Cloudflare while 56 arrived from it, a 3.9:1 loss ratio. Across the full observation period the totals are 669 out and 105 in. Every other competitor is rounding error by comparison: SiteLock accounts for 109 departures, Akamai for 30.

That number needs one honest qualification. Cloudflare and Imperva run together on 3,917 domains in our data, 12.98% of the base, and we confirmed a live example on Vodafone's careers site returning Cloudflare and Imperva headers on the same response. Because we observe what the edge returns, a CDN placed in front of an origin-side WAF can look like a departure when the WAF is still there. The direction of travel is real; the magnitude is an upper bound.

"Imperva loses roughly four domains to Cloudflare for every one it wins back. But the two run together on nearly 13% of Imperva's base, so read that ratio as a ceiling, not a headcount." - David Thomson, CTO at TechnologyChecker.io

Sales Signal: This is a two-sided opportunity. Departing accounts are actively re-evaluating edge security and are open to migration and WAF-tuning services. Accounts running both are candidates for consolidation, and they have already shown budget for two vendors.

Technology ecosystem

The co-installed stack confirms the enterprise read. OneTrust appears on 16.68% of Imperva domains against 2.33% for the SMB-oriented CookieYes, a seven-to-one split that tracks procurement maturity more reliably than company size does. Google Tag Manager runs on 67.55%. The interesting gap is bot protection: reCAPTCHA sits on 16.07% of Imperva sites while Imperva's own advanced bot tier is far less visible, which means a sizeable share of the base is paying Imperva for the WAF and handling bots with a free Google product. Our bot traffic research puts automated traffic at 34.9% of all requests, so that gap is not a small one.

Sales Signal: The reCAPTCHA overlap is the clearest upsell in the dataset. Roughly 4,850 domains already trust Imperva at the edge yet run a free CAPTCHA for bot defence, and they are the shortest path to an expansion conversation.

G2 review signals

G2 reviewers rate Imperva highest for blocking external attacks, and the top four pros all restate that single strength rather than naming separate features. The criticism is more informative: configuration complexity and false positives tie as the leading complaints. Our crawl data corroborates both. The 3.9:1 migration ratio toward Cloudflare runs in exactly the direction that a complexity complaint predicts, since Cloudflare's entire proposition is that the edge should be simple to operate. And the false-positive criticism is the same behaviour that returned 403s on ten of the fifty largest deployments we checked. Imperva's strongest review and its weakest review describe the same product decision.

Sales Signal: Lead with operational cost, not protection quality. Nobody is leaving Imperva because it fails to block attacks. They are leaving because tuning it is work.

Key takeaways

1. Rank is misleading. Third by domain count, but the two above it protect small sites at volume.
2. The base is bimodal, 58.11% under 50 staff and 12.17% over 1,000, and the two halves buy differently.
3. Regulated finance is the core vertical at 15.13% combined.
4. Cloudflare is the only meaningful competitive threat, at 3.9:1 against, though partly overstated by chaining.
5. The moat is compliance; the vulnerability is operational complexity, which is what reviewers and migration data both say.
6. Bot protection is the open upsell, with reCAPTCHA on 16.07% of the base.

Sales applications

Outreach angle: "You're running Imperva at the edge and reCAPTCHA for bots. We see that split on about 4,850 domains, and it usually means bot policy grew separately from the WAF." Targeting: filter this list on TechnologyChecker.io for 1,000-plus employees in insurance, banking and financial services, then intersect with OneTrust to isolate accounts with a formal compliance function. Competitive angle: the 219 domains that moved to Cloudflare in the last 30 days are mid-migration and are the most reachable accounts on this page.

Every figure above comes from our own crawl and enrichment: 28,846 active Imperva domains and 17,028 enriched companies. Filter the list above by size, country and industry, or compare it against the rest of the WAF & DDoS Protection category on TechnologyChecker.io.