The retained core offer is a configured F5 Distributed Cloud WAF subscription priced through F5. Buyers should obtain the exact Regional Edge inspected-request rate, Customer Edge App Firewall rate, included usage, load-balancer or platform charges, payment schedule, commitment, renewal, support, and implementation terms in the order. The AWS Marketplace PAYG listing is a broader Distributed Cloud Services route, and the public 12-month contract amount belongs to WAAP rather than WAF alone.
F5 Distributed Cloud Services SaaS PAYG on AWS Marketplace: The exact WAF page links to this no-end-date, cancellable AWS Marketplace route, but the listing sells the broader Distributed Cloud Services suite. Its displayed base-package and placeholder dimensions do not establish an exact WAF-only amount, so no route offer is retained.
F5 Distributed Cloud WAAP contract on AWS Marketplace: This 12-month AWS Marketplace route sells the broader F5 Distributed Cloud WAAP scope. Its public amount is not a WAF-only price and is excluded from the target plan, starting price, and cost conclusions.
$0.006849315 USD · per security policy · per hour · Standard security-policy usage · usage based · no commitment
$0.001369863 USD · per rule · per hour · Standard rule usage · usage based · no commitment
$0.75 USD · per 1,000,000 globally scoped requests · per usage unit · Standard global request usage · usage based · no commitment
$0.60 USD · per 1,000,000 regionally scoped requests · per usage unit · Standard regional request usage · usage based · no commitment
Cloud Armor Enterprise Paygo
$200 USD · per project · per month · Enterprise Paygo project rate · no commitment
Cloud Armor Enterprise Annual
$3000 USD · per billing account · per month · Enterprise Annual billing-account rate · one-year commitment
Standard has no subscription charge but bills each policy, rule, and request unit. Enterprise Paygo is USD 200 per project per month with no commitment and two protected resources included. Enterprise Annual is USD 3000 per billing account per month with a one-year commitment and 100 protected resources included. Enterprise data processing, protected-resource overages, reCAPTCHA, load balancing, and CDN services can add cost.
Enterprise security teams protecting distributed web applications across public cloud, on-premises, and edge locations
Organizations that want SaaS WAF enforcement with central policy, observability, API automation, Terraform, and SIEM-oriented integrations
Teams that need signature staging, automatic false-positive suppression, behavioral analysis, and AI-assisted risk-based enforcement
Google Cloud application teams protecting supported external or regional load-balanced services
Hybrid and multicloud workloads that can be fronted by Google Cloud load balancing
Organizations needing edge-enforced OWASP rules, rate limiting, DDoS controls, logging, and Google Cloud security integrations
Not for
Buyers requiring a public fixed WAF-only amount and fully specified contract terms before contacting F5
Teams requiring an appliance, virtual appliance, or Kubernetes-native WAF rather than the Distributed Cloud SaaS service
Buyers assuming full API Security, advanced Bot Defense, broader DDoS mitigation, managed operations, or other Distributed Cloud services are included automatically
Origins that cannot use a supported Google Cloud load-balancer or Cloud Armor attachment point
Buyers requiring a full API discovery, posture, testing, and runtime-security lifecycle in one product
Teams expecting advanced bot risk assessment to be bundled without separate reCAPTCHA billing
Source check
97/100
99/100
Key features
Signature and behavior-based web application threat detection
OWASP Top 10, CVE, threat-campaign, malicious-user, Layer 7 attack, and automated-threat controls
AI-powered request risk scoring with configurable risk-based blocking
Automatic attack-signature tuning using probabilistic learning
Monitoring and blocking modes with new and updated signature staging
Preconfigured OWASP Core Rule Set protections and custom L3-to-L7 rule language
Allow, deny, throttle, rate-based ban, redirect, and request-decoration actions where supported
Global edge enforcement with supported backend, edge, network-edge, and hierarchical policy types
REST, JSON, and GraphQL-over-HTTP request-body parsing for preconfigured WAF inspection
Adaptive Protection anomaly detection with full signatures and suggested rules on Enterprise
Cons
Exact WAF rates, included usage, payment timing, commitment, renewal terms, minimums, support, and implementation charges are not public.
Customer Edge WAF count and Regional Edge inspected-request volume can both affect billable usage, and broader platform or load-balancer charges require order-level confirmation.
Full API Security, advanced Bot Defense, broader DDoS mitigation, managed services, and other Distributed Cloud capabilities have separate product or service scope.
Preconfigured WAF rules require supported load-balanced backend services, so load-balancing architecture, quotas, and charges remain prerequisites.
Enterprise data-processing fees are additional to Cloud Load Balancing and network data-transfer fees.
reCAPTCHA assessment is separately billed even when Cloud Armor rules consume its tokens or redirect users for assessment.
Category buying score
75
77Higher category-fit score
Rank
#7
#5
Context
Security & Privacy / Web Application Firewall (WAF) Software
Security & Privacy / Web Application Firewall (WAF) Software
Protection efficacy
85AI-powered request risk scoring, automatic signature tuning, and blocking decisions based on behavior and signatures indicate a protection model built for active threat reduction, while the required policy and staging choices keep efficacy tied to configuration quality.
81Leverages OWASP rules and rate limits to block threats, but does not parse XML request bodies and caps inspection at 64 kB.
Policy accuracy and tuning
83Probabilistic automatic signature tuning, staging of new and updated signatures, and explicit exclusions help reduce false positives, with accuracy still dependent on ongoing policy review by the buyer.
75Preconfigured WAF inspection supports request-body parsing for REST, JSON, and GraphQL-over-HTTP, which can improve rule targeting for modern application traffic. The score is reduced because XML body parsing is unsupported and the request-body inspection limit can leave some payloads outside full inspection coverage.
Application and API coverage
66The WAF clearly covers web-application protection, but the facts do not establish full API Security entitlement in the core WAF, so application coverage is strong for web traffic and only partially established for API-specific controls.
77Coverage includes supported load-balanced applications, APIs, CDN origins, and hybrid or multicloud endpoints fronted by Google Cloud load balancing, but any origin without a supported attachment point stays outside the protection path.
Security operations
78Dashboards, alerting, SIEM-oriented integrations, public APIs, vesctl, and Terraform support day-to-day security operations and automation for teams that integrate those channels.
76Supported response actions include allow, deny, throttle, rate-based ban, redirect, and request decoration with logging and monitoring hooks, while Annual DDoS response support additionally requires Premium Cloud Customer Care, project enrollment, and a successful posture review.
Performance and reliability
70The SaaS delivery model and central monitoring support operational reliability, but the facts do not state explicit uptime, failover, or performance commitments, so reliability is supported more by architecture than by guaranteed service metrics.
79Global edge enforcement and supported policy types support consistent protection delivery across Google Cloud ingress points. The score is tempered because the facts do not establish measurable latency, propagation timing guarantees, or end-to-end reliability SLOs.
Deployment and integrations
80The product supports public APIs, vesctl, Terraform, alerting, and SIEM-oriented integrations, which gives it strong deployment and toolchain fit for teams that automate security operations around the WAF.
83Native integration with supported load balancers, Cloud CDN, Media CDN, GKE, reCAPTCHA, Cloud Logging, Cloud Monitoring, and Security Command Center, plus internet network endpoint groups for hybrid backends, anchors deployment inside Google Cloud architectures.
Support and total cost
47Pricing is usage-metered and quote-led without public WAF-only rates or included usage, and adjacent services such as API Security or advanced Bot Defense can add separate cost, so total cost depends on negotiated order terms.
60Standard meters each security policy, rule, and request unit with no subscription, Enterprise Paygo charges USD 200 per project per month with two included protected resources and no commitment, and Enterprise Annual charges USD 3000 per billing account per month with a one-year commitment and 100 included protected resources, while reCAPTCHA, Enterprise data-processing, load-balancing, CDN, overages, and Premium Care conditions add further cost components.
These are the stored dimension rationales returned with each score. They explain the buyer conditions behind the gap without speculating about hidden model reasoning.
Support and total cost
13 pts
F5 Distributed Cloud WAF · 47/100
Pricing is usage-metered and quote-led without public WAF-only rates or included usage, and adjacent services such as API Security or advanced Bot Defense can add separate cost, so total cost depends on negotiated order terms.
Google Cloud Armor · 60/100
Standard meters each security policy, rule, and request unit with no subscription, Enterprise Paygo charges USD 200 per project per month with two included protected resources and no commitment, and Enterprise Annual charges USD 3000 per billing account per month with a one-year commitment and 100 included protected resources, while reCAPTCHA, Enterprise data-processing, load-balancing, CDN, overages, and Premium Care conditions add further cost components.
Application and API coverage
11 pts
F5 Distributed Cloud WAF · 66/100
The WAF clearly covers web-application protection, but the facts do not establish full API Security entitlement in the core WAF, so application coverage is strong for web traffic and only partially established for API-specific controls.
Google Cloud Armor · 77/100
Coverage includes supported load-balanced applications, APIs, CDN origins, and hybrid or multicloud endpoints fronted by Google Cloud load balancing, but any origin without a supported attachment point stays outside the protection path.
Performance and reliability
9 pts
F5 Distributed Cloud WAF · 70/100
The SaaS delivery model and central monitoring support operational reliability, but the facts do not state explicit uptime, failover, or performance commitments, so reliability is supported more by architecture than by guaranteed service metrics.
Google Cloud Armor · 79/100
Global edge enforcement and supported policy types support consistent protection delivery across Google Cloud ingress points. The score is tempered because the facts do not establish measurable latency, propagation timing guarantees, or end-to-end reliability SLOs.
Research basis
Research basis
This page uses stored product facts, official evidence, and category scoring rationales. It is not an account-based hands-on test, and third-party user ratings are not folded into the category buying score.
F5 Distributed Cloud WAF
Fact confidence: 97% · Fact checked: 2026-08-12
Google Cloud Armor
Fact confidence: 99% · Fact checked: 2026-08-12
More tools
Web Application Firewall (WAF) Software
Add more tools from the same subcategory to this comparison. The page keeps up to 6 tools.
Fortinet FortiWeb is a self-managed web application and API firewall delivered as hardware, virtual, container, and public-cloud appliances, with machine-learning detection, API discovery and schema controls, bot mitigation, and Fortinet Security Fabric integrations.
Barracuda Web Application Firewall is a customer-operated web application and API firewall available as a physical appliance or virtual appliance for on-premises, private-cloud, AWS, and Azure deployment.
Fastly Next-Gen WAF is a hybrid web application and API firewall that uses contextual request detection, shared threat intelligence, signals, rules, thresholds, and centralized visibility across edge, Fastly-hosted cloud, and customer-managed deployments.
Azure Web Application Firewall provides managed and custom web-traffic protection through Application Gateway WAF v2, Application Gateway for Containers WAF, and Azure Front Door WAF deployment routes, with deployment-specific rules, scaling, monitoring, and pricing meters.
Google Cloud Armor is Google Cloud's edge security service for applying WAF, access-control, rate-limiting, and DDoS protections to supported load-balanced applications, APIs, CDN origins, and selected network endpoints.
Cloudflare Web Application Firewall is a cloud-delivered edge WAF that filters web and API requests with managed rulesets, custom rules, rate limiting, analytics, and plan-dependent security controls.
Akamai App & API Protector is a cloud-delivered web application and API protection service that combines an adaptive WAF, Layer 7 DDoS defense, API discovery, basic bot controls, security analytics, and DevOps automation at Akamai's edge.
AWS WAF is a cloud-native web application firewall for CloudFront and supported regional AWS resources, priced by web ACLs, rules or attached rule groups, and inspected requests, with separately charged intelligent threat-mitigation features.
Imperva Web Application Firewall is a WAF product family with SaaS Cloud WAF, locally managed WAF Gateway, and Kubernetes-based Elastic WAF deployment offers for protecting web applications and API traffic.
72
More comparisons
More same-subcategory comparisons for F5 Distributed Cloud WAF
Compare the first tool against top-ranked and nearby tools in the same subcategory.