OWAF’s bet
European-hosted inspection, CRS you can tune, console-first ops, and no per-request billing surprises.
Market context for the OWAF alpha
Competition and competitive analysis
OWAF is a managed, inline Web Application Firewall on OVHcloud, built on OWASP CRS 4.x. It competes with hyperscaler WAFs, CDN-embedded firewalls, appliance vendors, and do-it-yourself ModSecurity stacks — not on global PoP count, but on control, European data residency, and predictable cost.
How to read this page
This is an educational comparison for the protected demo at
waf.success.ovh. Capabilities for OWAF reflect the
labs alpha. Peer products
are described from publicly documented positioning; they change often.
Where others win today
Global anycast, bot ML at scale, multi-cloud SaaS, mature APIs/Terraform, and decades of rule telemetry.
Alpha honesty
Single region (GRA), Admin UI only, OVH-managed TLS, HTTP/1.1 and HTTP/2. API, Terraform, and Public Cloud glue are on the GA roadmap.
Competitor landscape
Four buying patterns show up when teams evaluate a WAF in front of an origin like this one.
Attach to the cloud you already run
AWS WAF, Azure WAF, and Google Cloud Armor win when the app, load balancer, and identity already live in that cloud. Switching cost is the platform, not the rule set.
Put the firewall on the cache network
Cloudflare, Akamai, and Fastly combine WAF, DDoS, and (often) CDN. They shine for global latency and volumetric attacks; traffic and logs leave your hosting region.
Own the box, own the policy
F5, Imperva, and Fortinet sell software or hardware with deep protocol control. High capability, high operating cost, slower to stand up than a managed service.
Run CRS yourself
ModSecurity, Coraza, CrowdSec, and NGINX App Protect give the same class of engine OWAF wraps — you supply the platform, tuning, TLS, and on-call.
Competitor list
Primary alternatives a team would shortlist next to OVHcloud WAF.
Cloudflare WAF
Managed rules, custom WAF, bot fight, and API shield on a global anycast network. Fastest path for many public sites; US-based control plane and usage-shaped billing.
AWS WAF
Web ACLs on CloudFront, ALB, API Gateway, and AppSync. Managed rule groups plus per-request, per-rule metering. Native if the origin is already in AWS.
Azure WAF
OWASP CRS on Application Gateway or Azure Front Door. Strong Microsoft-stack fit; policy complexity follows the chosen SKU (regional vs global).
Google Cloud Armor
Edge policy on HTTP(S) load balancing and Cloud CDN. Adaptive protection and Google threat intel; least relevant if you are not on GCP.
Akamai App & API Protector
Long-standing enterprise WAF plus bot and API security. Deep SOC workflows and global footprint; typically sold and operated as a platform, not a checkbox.
Fastly Next-Gen WAF
Signal Sciences lineage: decisioning that is less CRS-centric, strong for APIs and templated apps. Deploy at Fastly edge, in-cloud modules, or reverse proxy.
Imperva WAF
Cloud and on-prem application security with DDoS, bot, and API add-ons. Competes for regulated enterprises that want a specialist vendor, not a cloud attach.
F5 BIG-IP & NGINX App Protect
Signature and behavioral WAF as ADC software or NGINX module. Maximum control in private networks; you run capacity, HA, and upgrades.
ModSecurity + OWASP CRS
The same rule family OWAF ships. Self-hosted on nginx/Apache. Zero license cost, full ops burden: false-positive tuning, logging, TLS, and scale.
CrowdSec
Collaborative IDS/WAF-adjacent controls, French company, community blocklists. Complements a reverse proxy more than it replaces a full CRS reverse-proxy WAF.
Coraza
CRS-compatible engine (Go) used with Caddy, Envoy, and others. Attractive for platform teams building their own edge; not a managed console product.
Fortinet FortiWeb, Sucuri
FortiWeb is a classic appliance/VM WAF. Sucuri is a hosted cleanup-plus-WAF for smaller sites. Different buyer, sometimes the same RFP line item.
Snapshot comparison
Buying dimensions that actually decide a shortlist. “Partial” means the capability exists with caveats (SKU, region, extra product, or roadmap).
Yes native / in-product
Partial limited, add-on, or roadmap
No not the product’s model
| Dimension | OWAF | Cloudflare | AWS WAF | Azure WAF | Fastly NGWAF | CRS DIY |
|---|---|---|---|---|---|---|
| Inline reverse-proxy WAF | Yes | Yes | Partial | Yes | Yes | Yes |
| OWASP CRS 4.x as default engine | Yes | Partial | Partial | Yes | No | Yes |
| EU data plane you choose (OVH GRA) | Yes | Partial | Partial | Partial | Partial | Yes |
| Predictable price (not per request) | Yes | Partial | No | Partial | Partial | Yes |
| Console to tune rules without redeploy | Yes | Yes | Yes | Yes | Yes | No |
| Public API / Terraform today | Partial | Yes | Yes | Yes | Yes | Partial |
| Global anycast / CDN included | No | Yes | Partial | Partial | Yes | No |
| Customer-supplied TLS cert (today) | Partial | Yes | Yes | Yes | Yes | Yes |
| Managed for you (no WAF cluster to run) | Yes | Yes | Yes | Yes | Yes | No |
| Virtual patching / custom rules | Yes | Yes | Yes | Yes | Yes | Yes |
| Detection (log-only) vs blocking modes | Yes | Yes | Yes | Yes | Yes | Partial |
AWS WAF is typically attached to CloudFront or an ALB rather than a generic reverse proxy. Cloudflare’s managed rules are not a drop-in CRS 4.x port. OWAF Terraform/API and customer certificates are documented as roadmap items before GA.
Vendor-by-vendor analysis
What each competitor optimizes for, and how that lands against OWAF’s alpha shape.
Cloudflare WAF — default alternative for public HTTPS
Strengths: enormous edge, one-click managed rules, bot and cache products in the same dashboard, excellent time-to-protect. Trade-offs: control plane and much of the data path sit outside OVHcloud; advanced bot/API features sit on higher plans; billing can mix subscriptions and usage. Versus OWAF: pick Cloudflare when global performance and a full edge suite matter more than keeping inspection and logs on OVH infrastructure. Pick OWAF when the origin is already on OVHcloud and sovereignty plus CRS transparency are the brief.
AWS WAF — native if the app is already in AWS
Strengths: IAM, CloudWatch, Firewall Manager, and managed rule groups (including CRS-derived packs) wired into AWS load balancers. Trade-offs: classic surprise bills (web ACLs + rules + requests); policy is AWS-shaped, not “point DNS at a WAF IP in front of any origin.” Versus OWAF: not a like-for-like swap for an OVH-hosted site. Teams running hybrid estates sometimes put Cloudflare or OWAF in front of OVH and AWS WAF only on AWS-native APIs.
Azure WAF — CRS on Microsoft’s front door
Strengths: first-class OWASP CRS (including newer CRS generations on current SKUs), Detection/Prevention modes, and Azure Policy. Trade-offs: you buy Application Gateway or Front Door semantics; tuning CRS false positives is still specialist work; data residency follows Azure regions and Microsoft’s operator model, not OVHcloud’s. Versus OWAF: closest hyperscaler cousin on engine (CRS), farthest on placement unless the backend is Azure.
Google Cloud Armor — edge policy for GCP load balancers
Strengths: Google’s DDoS fabric, adaptive protection, named IP lists, preview/analyze modes. Trade-offs: almost no value if you are not terminating on a GCP URL map. Versus OWAF: ignore in an OVH-only architecture; relevant only in multi-cloud RFPs that score “has a hyperscaler WAF” as a checkbox.
Akamai App & API Protector — enterprise platform
Strengths: threat research, professional services, API discovery, and proven large-scale blocking. Trade-offs: commercial and operational weight; overkill for a single origin demo; logs and config live in Akamai’s world. Versus OWAF: different altitude. Akamai is a security platform purchase. OWAF is “turn on CRS in front of my OVH service this week.”
Fastly Next-Gen WAF — less signature, more signals
Strengths: strong API and application-aware detections, flexible deploy (edge, module, reverse proxy), thoughtful thresholding instead of raw CRS scores. Trade-offs: another vendor plane; Fastly network if you want the edge form; pricing is product-packaged rather than “included with the hypervisor.” Versus OWAF: better fit when CRS false positives are the reason you left ModSecurity. OWAF is the better fit when you want CRS 4.x, paranoia levels, and an OVH console.
Imperva — specialist WAF vendor
Strengths: dedicated application-security company, cloud and on-prem options, DDoS and bot add-ons. Trade-offs: another contract, another console, overlapping DDoS with what many teams already buy from their CDN or cloud. Versus OWAF: Imperva wins complex, multi-environment estates that want a pure-play WAF vendor. OWAF wins OVH-centric teams that refuse a second security cloud.
F5 / NGINX App Protect — maximum mechanical control
Strengths: protocol depth, iRules/NGINX config, private-network placement, signatures plus (on some SKUs) behavioral engines. Trade-offs: you own HA, scaling, software lifecycle, and often a sizeable license. Versus OWAF: choose F5 when the WAF must sit in your VPC as an ADC. Choose OWAF when you want the same class of HTTP inspection without running the cluster — the model this demo uses.
ModSecurity + CRS (DIY) — the engine without the product
Strengths: identical rule literacy; logs on disk you already own; no vendor roadmap risk; works anywhere nginx runs. Trade-offs: paranoia-level tuning, SecRule syntax, CRS updates, TLS, 403 pages, metrics, and 3 a.m. false positives are yours. That is exactly the toil OWAF’s console, live stats, and managed CRS library are built to remove. Versus OWAF: DIY is cheaper in license and more expensive in people. If you already have a platform team happily running CRS, OWAF is optional. If you wanted CRS without becoming a ModSecurity expert, OWAF is the productized version.
CrowdSec — European, collaborative, different layer
Strengths: French company, community-sourced decisions, agents that ban abusive IPs across a fleet, cheap to start. Trade-offs: not a full inline CRS reverse proxy with body inspection and virtual patching as the primary model. Versus OWAF: complementary more than substitute. CrowdSec is strong at reputation and brute-force; OWAF is strong at request payload inspection. Some estates will run both.
Coraza — CRS for modern proxies
Strengths: memory-safe engine, Caddy/Envoy stories, CRS compatibility without the ModSecurity C library. Trade-offs: you assemble the product: UI, multi-tenant policy, TLS at the edge, support. Versus OWAF: Coraza is an engine for builders. OWAF is a service for operators who want CRS 4.x in front of an OVH origin today.
Strategic analysis
Where OWAF is structurally strong, where it is not (yet), and who should shortlist it.
Strengths
European sovereignty by construction (requests, logs, and rules on OVHcloud). Transparent OWASP CRS 4.x with paranoia levels, Detection vs Blocking, and custom rules (up to 500). Inline placement that matches how this demo is published: DNS to WAF ingress, origin never sees 403s. Predictable pricing narrative versus AWS-style request metering. Zero-config start with a console for exceptions.
Weaknesses (alpha)
One region (eu-west-gra). No public API or Terraform yet. TLS is
OVH-managed; bringing your own certificate is roadmap. WebSockets are proxied,
not deeply inspected. No bundled global CDN or anycast. Bot and account-takeover
stories are real use cases, but hyperscalers have more years of ML telemetry.
Opportunities
OVH Public Cloud customers who currently bolt Cloudflare in front of GRA/SBG only for WAF. Teams blocked by NIS2, DORA, or internal “no US SaaS on the data path” policies. Operators exhausted by ModSecurity but unwilling to leave CRS. GA items (API, Terraform, tighter Public Cloud integration) close the gap with AWS/Azure on automation.
Threats
Cloudflare’s default-on muscle memory. Hyperscaler bundling (“WAF is a checkbox on the load balancer”). Fastly/Imperva winning API-heavy roadmaps. Open-source CRS remaining “good enough” for shops that already have nginx skill. Perception risk while the product is alpha: buyers may wait for GA before production.
When to choose which
A practical decision table for architects comparing this origin’s protection model to the market.
| If your constraint is… | Shortlist | Why |
|---|---|---|
| Keep HTTP inspection and logs on OVHcloud (GRA) | OWAF, or DIY CRS on OVH instances | Only these keep the data plane on the same operator as the origin. |
| Global cache + WAF in one vendor | Cloudflare, Akamai, Fastly | OWAF is a firewall, not a CDN. Pair a CDN later if needed. |
| App already behind ALB / Front Door / GCP HTTPS LB | AWS WAF, Azure WAF, Cloud Armor | Attach-native beats inserting a second reverse proxy. |
| Need CRS with a UI, not a git repo of SecRules | OWAF, Azure WAF | Both expose CRS modes; OWAF does it in front of a generic origin. |
| Fear of per-request security invoices | OWAF, DIY CRS, some flat Cloudflare plans | AWS WAF metering is the cautionary tale in this category. |
| GitOps / Terraform on day one | AWS, Azure, Cloudflare, Fastly | Wait for OWAF GA API, or wrap console changes in process for now. |
| Private network WAF next to the app | F5 / NGINX App Protect, ModSecurity, Coraza | OWAF alpha is an internet inline ingress, not an internal sidecar. |
| Emergency virtual patch on Friday night | OWAF custom rules, Cloudflare custom rules, DIY CRS | All three can ship a deny without an application release. |
Bottom line
OWAF’s competitive slot
OWAF is not trying to be a global CDN. It is the managed CRS layer for workloads that already trust OVHcloud with compute and data. Against Cloudflare and the hyperscalers it trades reach and automation maturity for residency, pricing clarity, and rule transparency. Against DIY ModSecurity it trades operational toil for a console, live stats, and a supported rule library.
For this demo, that slot is literal: clients hit OWAF, blocked requests get 403, and only allowed traffic reaches the nginx origin that serves these pages.
