Companies Using Imperva

I'm David Thomson, CTO at TechnologyChecker.io. This analysis covers 28,777 Imperva domains from our October 2026 crawl, 16,284 of them matched to a company record, 56.59% of the base. Imperva identifies itself in the HTTP response: an X-CDN header naming Imperva or Incapsula, an X-Iinfo header, or a script under /_Incapsula_Resource. Detection doesn't depend on a consent banner or on JavaScript running. It only sees the cloud WAF, though. Imperva's on-premises, API and data security products, and the RASP it bought with Prevoty, leave nothing on a web page.

Growth trajectory

The chart reads 26,640 in June, 29,475 in July, then 28,846, 28,829 and 28,777. Since July the line has barely moved. The June to July step comes from our side: the domains we crawl turn over every month as dead sites drop out and new ones are found, and our detection widens. 8,050 domains have dropped Imperva since mid-March 2026, and new ones have replaced them at about the same pace.

"Imperva's footprint has held at about 28,800 domains for four months. In this category, a flat line on regulated buyers is worth more than a rising one on small sites." - David Thomson, CTO at TechnologyChecker.io

Sales Signal: this is a stable, renewal-driven base. Don't pitch it as a growth segment. Time outreach to renewals and to properties that change hands, such as a new careers portal or a regional site.

What the 12% is a share of

Imperva holds 12% of our WAF & DDoS Protection category, 3rd of 18. Sucuri (94,053 domains) and DDoS-Guard (91,034) are ahead on count because they protect large numbers of small sites. Cloudflare sits outside the table: its WAF is part of the CDN product we file under CDN, and its profile counts 9,236,181 domains. So the 12% is a share of dedicated WAF and DDoS services, and Imperva's real competition is bigger than the table shows.

Sales Signal: size the Imperva opportunity by account, not by domain share. The 1,969 matched companies with more than 1,000 staff (1,125 + 324 + 520) are where contract value sits.

Who the customers are

The size chart has two humps. 35.74% of matched companies have 1 to 10 employees and 19.88% have 11 to 50, while 12.99% have more than 1,000 (7.42% + 2.14% + 3.43%). Age splits the same way: the 2010s lead at 21.28%, but companies founded before 1960 are second at 19.84%. The enterprise half is real and checkable. PepsiCo, Standard Chartered, BAE Systems, Zurich, Generali, Johnson Controls and BAT returned Imperva's headers on their main domains on 10 October. PwC, Vodafone, Domino's and Deere run it on one property each: a talent exchange, a careers site, a business site and a technical publications store.

Sales Signal: work two lists. Small sites buy self-serve and leave on price. The large accounts buy through security and procurement teams and renew on contract, and that's where WAF tuning, bot management and compliance services sell.

Industries and countries

Insurance (7.41%), financial services (5.95%) and banking (2.92%) make 16.28% of matched companies, the clearest vertical signal here. Hospitality is third at 3.27%, with Accor among the named sites. Veterinary Services at 2.14% looked out of place, so we sampled it. The clinic sites that loaded, such as evidensia.fi, belong to the IVC Evidensia group, and edz-denhaag.nl redirects to an Evidensia hospital site, so that line is one group's estate. Geographically, the United States has 6,696 matched companies and the United Kingdom 1,515, and Spain is fifth with 616, ahead of France (439) and Germany (333). Brazil (350) includes Ambev, Assaí and the State of São Paulo.

Sales Signal: regulated finance is the warmest segment, because a WAF is a compliance line item there. Spanish- and Portuguese-language markets carry more Imperva accounts than their size suggests and deserve a local motion.

Overlap with other vendors

No competitor pair passes our switching tests. Since March 2026, 1,153 domains that dropped Imperva now run Cloudflare and 146 went the other way, but 4,298 of the 5,693 domains ever seen with both still run both. SiteLock took 156 and returned 10, with 165 of 365 still on both. Akamai ran 44 to 21, with 270 of 341 still on both, and AWS WAF ran 11 to 1 towards Imperva. One more caution for anyone building a list: two ethics-hotline subdomains among our candidates redirect to a hotline vendor, and the Imperva headers there belong to the vendor, so we removed them.

"Most Imperva sites that run Cloudflare keep both. The domains that leave are real, but they're a few hundred a quarter out of almost 29,000." - David Thomson, CTO at TechnologyChecker.io

Sales Signal: the 4,298 domains running Imperva and Cloudflare together are paying two vendors for overlapping edge security. That's a consolidation conversation for either side, and a tuning opportunity for consultants.

The stack around it

Google Tag Manager runs on 69.14% of the 29,152 live Imperva domains in our stack sample. OneTrust is on 16.64% against 2.52% for CookieYes, which points to formal privacy programmes. reCAPTCHA is on 16.73% and Cloudflare Bot Management on 4.35%, so a good share of customers handle bots with something other than Imperva's own bot product. Adobe Experience Platform Launch (4.2%) and Adobe DTM (4.0%) mark the larger marketing teams.

Sales Signal: the reCAPTCHA overlap is the clearest upsell. These sites already trust Imperva at the edge and still run a separate bot check.

What G2 reviewers say

G2 reviewers' top pros all describe one strength, stopping attacks: 23, 21 and 16 mentions across three phrasings. The cons are smaller and split evenly: configuration complexity, false positives and the interface each have 4 mentions, and licensing cost 2. Our own checks agree with the false-positive point. Plain requests to several large Imperva sites, United's cruise site and Safeway among them, came back as challenge pages.

Sales Signal: lead with operational cost, not protection quality. Reviewers don't doubt that Imperva blocks attacks; they say it takes work to tune.

Key takeaways

1. 28,777 domains in October 2026, flat since July, 3rd of 18 with 12%.

2. The 12% excludes Cloudflare, Imperva's largest real rival.

3. Two customer bases: 35.74% at 1 to 10 staff and 12.99% above 1,000 (7.42% + 2.14% + 3.43%).

4. Regulated finance is the core at 16.28% (7.41% + 5.95% + 2.92%), and companies founded before 1960 are 19.84% of the base.

5. Overlap with Cloudflare is mostly coexistence: 4,298 of 5,693 domains still run both.

How to use this list

Filter for 1,000+ employees in insurance, banking and financial services, then intersect with OneTrust to find accounts with formal compliance teams. For a bot-management pitch, filter for reCAPTCHA. The full list of 28,777 Imperva domains, with 16,284 matched companies, is on TechnologyChecker.io.