Vendor comparison
AWS WAF vs FortiWeb Cloud: pricing compared
AWS-native per-request billing versus AWS Marketplace per-app appliance. Both bill through the same AWS invoice, but the math is opposite. AWS WAF scales with request volume; FortiWeb Cloud scales with application count and bandwidth.
Last verified June 2026
Decision in one paragraph
AWS WAF wins on per-request granularity and on tight integration with CloudFront, ALB, and API Gateway. FortiWeb Cloud (renamed FortiAppSec Cloud in late 2024) wins on per-app predictability and on parity with Fortinet's broader appliance posture if you already run FortiGate. Pick AWS WAF for cloud-native dynamic apps. Pick FortiWeb Cloud for a fixed number of stable apps where per-app math is preferable.
Side by side
AWS WAF
- $5 web-ACL + $1/rule + $0.60/M requests; Bot Control adds $10 + per-request.
- Native integration with ALB, CloudFront, API Gateway, App Runner.
- Scales linearly with request volume, predictable at steady traffic.
- AWS Managed Rules + third-party Marketplace rule groups.
- No bandwidth surcharge; CloudFront egress is billed separately.
Fortinet FortiWeb Cloud
- 0.14 points ($0.14)/app-hour (~$102/mo) + 5 Mbps bandwidth minimum (~$133/mo), ~$235/app/mo floor.
- Per-app predictability; cost scales with application count, not request volume.
- FortiGuard threat intelligence shared with FortiGate appliances.
- Available on AWS Marketplace PAYG (1 point = $1) or Private Offer.
- Bandwidth billed per 5 Mbps block stacks fast on high-throughput apps.
Feature matrix
| Feature | AWS WAF | FortiWeb Cloud |
|---|---|---|
| Published list pricing | ✓ | ✓ |
| Per-request billing | ✓ | ✗ |
| Per-app billing | ✗ | ✓ |
| Bot management published rate | ✓ | ◐ |
| Native CloudFront integration | ✓ | ✗ |
| FortiGate ecosystem | ✗ | ✓ |
| Bandwidth-tier billing | ✗ | ✓ |
| AWS Marketplace listing | ✓ | ✓ |
Headline pricing
| Vendor | Cheapest published rate | Pricing model | Source |
|---|---|---|---|
| AWS WAF | $5.00 per web-ACL per month | Per web-ACL + per rule + per million requests | Source (2026-06-19) |
| Fortinet FortiWeb Cloud | $0.14 per app-hour (WAF Standard), approx $102 per app per month before bandwidth | Cloud Marketplace points model: per app-hour + per-Mbps bandwidth (1 point = $1 PAYG) | Source (2026-06-26) |
Direct answer
Which is cheaper at typical traffic?
AWS WAF is almost always cheaper for a single app. AWS WAF runs ~$65/mo at 100M req/mo without Bot Control (web-ACL + $0.60/M, on top of your existing CloudFront/ALB). FortiAppSec Cloud has a hard ~$235/mo floor per app (0.14 points/app-hour plus the mandatory 5 Mbps bandwidth minimum) before any real throughput. FortiWeb only pulls ahead when you have many low-traffic apps and value per-app predictability and the FortiGate ecosystem over raw price.
Source: Use the cost calculator on the homepage to model your own workload.
Switching cost
If you are already on one and considering the other
AWS-WAF-to-FortiWeb migrations require pointing the DNS to a FortiWeb-fronted endpoint, re-tuning rules in FortiWeb's rule editor, and re-issuing TLS certs. FortiWeb supports CloudFront origin patterns. Expect 2-4 weeks of work per app. The reverse migration is similar in scope; AWS WAF's managed rule groups have different naming and structure than FortiGuard.
Where to read more
Cross-reference with the pricing-models explainer and the hidden-costs page before signing.
Last verified June 2026