Radware named Leader in 2026 IDC MarketScape for WAAP
Radware (NASDAQ: RDWR) has been recognised as a Leader in the IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment, published in September 2026. The ranking covers the company's cloud-delivered security platform, which spans web application firewalling, API protection, bot management, client-side protection, and distributed denial-of-service mitigation across cloud, on-premises, and hybrid environments.
The IDC assessment highlighted Radware's AI-based engine, which it said continuously maps API call sequences and workflow logic from live traffic to automatically generate and tune detection policies. According to the report, this approach is positioned by IDC as capable of catching business logic abuse that schema validation and static rule sets miss. The assessment also noted the recent introduction of Radware AI Xploit Shield, described as generating customised, automatically produced signatures for emerging attack patterns.
Gabi Malka, chief operating officer at Radware, said the recognition "reflects the continued evolution of our application security strategy," adding that the company continues to invest in AI-driven protection as AI reshapes both how applications are built and how they are attacked.
Market context
The web application and API protection market, commonly abbreviated as WAAP, has expanded rapidly as API-driven architectures proliferate and attack surfaces widen. Analysts and practitioners broadly agree that legacy web application firewalls, which rely on static signatures and manual rule tuning, struggle to keep pace with modern API sprawl and sophisticated business logic attacks. As a result, vendors across the sector have pivoted towards behavioural analytics and machine-learning-based detection.
Radware competes in this space against a crowded field that includes established security vendors such as Akamai, Cloudflare, F5, and Imperva, as well as hyperscaler-native offerings from AWS, Azure, and Google Cloud. Each is pushing AI-assisted detection and automated policy generation as a differentiator, making it an area where competitive advantage can erode quickly as capabilities converge. An IDC MarketScape Leader placement carries meaningful weight with enterprise procurement teams and often influences shortlisting decisions, particularly in regulated industries where third-party validation matters.
Regulatory and standards read-across
API security is increasingly a compliance consideration rather than a discretionary investment. The EU's NIS2 Directive, which became enforceable in October 2024, obliges in-scope organisations across critical sectors to demonstrate technical controls over their external-facing services, including APIs. In financial services, DORA adds a further layer of ICT risk management requirements that will require documented API protection postures from early 2025 onwards.
In the United States, the CISA Known Exploited Vulnerabilities catalogue has grown to include a significant proportion of web application and API flaws, reinforcing pressure on CISOs to adopt runtime protection rather than relying on periodic penetration testing. Radware's positioning around AI-automated policy generation speaks directly to the operational challenge of keeping up with the pace of vulnerability disclosure without expanding security team headcount.
The company did not disclose updated revenue figures, customer counts, or specific performance benchmarks alongside the announcement. Investors and enterprise buyers will be watching for concrete data on detection accuracy and false-positive rates as the market matures and competitive claims become harder to differentiate on positioning alone.