- Founded
- 2002-01-01 in San Mateo, California, United States
- Headquarters
- San Mateo, California, United States
- sales@imperva.com
- Phone
- (650) 345-9000
Imperva is a global cybersecurity company that protects enterprise applications, data, and APIs across on-premises, cloud, and hybrid environments. Founded in 2002 by cybersecurity veterans Shlomo Kramer, Amichai Shulman, and Mickey Boodaei, the company initially developed the SecureSphere web application firewall (WAF) and has since expanded through both organic growth and strategic acquisitions, including Incapsula, Distil Networks, Prevoty, and jSonar. Acquired by private equity firm Thoma Bravo in 2019 for $2.1 billion, Imperva was later purchased by French multinational Thales Group in December 2023 for approximately $3.6 billion and now operates as a subsidiary while maintaining its own brand. The company serves over 6,200 enterprise customers in 150 countries, including seven of the top ten U.S. commercial banks and 34% of the Fortune 100. Its comprehensive portfolio spans web application firewalls, DDoS mitigation, runtime application self‑protection, bot management, API security, and data security solutions such as Data Activity Monitoring and data masking. Headquartered in San Mateo, California, Imperva employs roughly 1,400 people and works with more than 500 channel partners worldwide.
Detailed Review
History and Founding
Imperva was founded in 2002 in San Mateo, California, by Shlomo Kramer (co‑founder of Check Point Software Technologies), Amichai Shulman, and Mickey Boodaei. The company’s first product, SecureSphere, was a web application firewall that quickly gained traction in the enterprise market. After rebranding to Imperva in 2004, it went public on the NYSE in 2011 and was later taken private by Thoma Bravo in 2019 for $2.1 billion. In a significant move, Thales Group acquired Imperva for $3.6 billion, completing the deal in December 2023.
Business Model and Revenue
Imperva generates revenue through a combination of subscription‑based cloud services and perpetual licenses for on‑premises appliances, with additional income from professional services and support. The company’s products are sold both directly and through a network of over 500 channel partners. Its customer base includes large enterprises, particularly in finance, healthcare, and technology, with strong penetration among Fortune 100 firms.
Core Products and Platforms
Imperva’s application security offerings include its Web Application Firewall (available as cloud, on‑premises, or hybrid), DDoS protection, API security, bot management, and account takeover protection. On the data security side, the company provides Data Activity Monitoring, data risk analytics, and data masking, covering more than 100 data repositories. The platform is recognized by analysts such as KuppingerCole (2025 Leadership Compass for Data Security Platforms) and has received multiple industry awards, including five Gold awards in runtime application protection, bot protection, API security, and security platform categories.
Market Position and Competitors
Imperva competes with other cybersecurity vendors such as Cloudflare, Akamai, F5 Networks, and Palo Alto Networks in application security, and with data security specialists like Thales (now its parent), IBM Security, and McAfee. The company’s acquisition by Thales strengthens its global reach and ability to offer integrated security solutions.
Recent Developments and Strategic Direction
Since joining Thales, Imperva has continued to innovate, launching the “Imperva Accelerate” partner program in 2025 and maintaining its own go‑to‑market strategy. The company remains focused on expanding its API security and data security capabilities, as evidenced by recent product enhancements and analyst recognition.
Key Products
Web Application Firewall (WAF)
Protects web applications from common attack vectors like SQL injection and XSS across cloud, on‑premises, and hybrid deployments.
DDoS Protection
Mitigates distributed denial‑of‑service attacks to ensure application availability.
Runtime Application Self‑Protection (RASP)
Embedded security within applications that detects and blocks attacks in real time.
API Security
Discovers, monitors, and protects APIs against abuse and data exfiltration.
Bot Management
Identifies and mitigates automated bot traffic such as scrapers and credential stuffing.
Account Takeover (ATO) Protection
Detects and blocks unauthorized access attempts using behavioral analysis.
Data Activity Monitoring (DAM)
Monitors all data access and activity across hundreds of data repositories for compliance and threat detection.
Data Risk Analytics
Provides risk‑based prioritization of data security alerts using machine learning.
Data Masking
Obfuscates sensitive data for non‑production environments, acquired from Camouflage in 2017.
Offices & Headcount
1400 employees (approx.)
Key Persons
- Pam Murphy
Chief Executive Officer (CEO)