Vendor comparison
AWS WAF vs FortiWeb Cloud: pricing compared
AWS-native per-request billing versus AWS Marketplace per-app appliance. Both bill through the same AWS invoice, but the math is opposite. AWS WAF scales with request volume; FortiWeb Cloud scales with application count and bandwidth.
Last verified June 2026
Decision in one paragraph
AWS WAF wins on per-request granularity and on tight integration with CloudFront, ALB, and API Gateway. FortiWeb Cloud (renamed FortiAppSec Cloud in 2026) wins on per-app predictability and on parity with Fortinet's broader appliance posture if you already run FortiGate. Pick AWS WAF for cloud-native dynamic apps. Pick FortiWeb Cloud for a fixed number of stable apps where per-app math is preferable.
Side by side
AWS WAF
- $5 web-ACL + $1/rule + $0.60/M requests; Bot Control adds $10 + per-request.
- Native integration with ALB, CloudFront, API Gateway, App Runner.
- Scales linearly with request volume, predictable at steady traffic.
- AWS Managed Rules + third-party Marketplace rule groups.
- No bandwidth surcharge; CloudFront egress is billed separately.
Fortinet FortiWeb Cloud
- $0.03/hr per app (~$21.90/mo base) + $0.40/GB traffic.
- Per-app predictability; cost scales with application count, not request volume.
- FortiGuard threat intelligence shared with FortiGate appliances.
- Available on AWS Marketplace PAYG or Private Offer.
- Bandwidth at $0.40/GB stacks fast on high-volume apps.
Feature matrix
| Feature | AWS WAF | FortiWeb Cloud |
|---|---|---|
| Published list pricing | ✓ | ✓ |
| Per-request billing | ✓ | ✗ |
| Per-app billing | ✗ | ✓ |
| Bot management published rate | ✓ | ◐ |
| Native CloudFront integration | ✓ | ✗ |
| FortiGate ecosystem | ✗ | ✓ |
| Bandwidth-tier billing | ✗ | ✓ |
| AWS Marketplace listing | ✓ | ✓ |
Headline pricing
| Vendor | Cheapest published rate | Pricing model | Source |
|---|---|---|---|
| AWS WAF | $5.00 per web-ACL per month | Per web-ACL + per rule + per million requests | Source (2026-06-19) |
| Fortinet FortiWeb Cloud | $0.03 per hour per app, approx $21.90 per app per month | AWS Marketplace per-hour per app + per-GB traffic | Source (2026-06-19) |
Direct answer
Which is cheaper at typical traffic?
Below ~50 GB monthly egress per app FortiWeb Cloud is cheaper because the $21.90 base beats AWS WAF's per-request math. Above ~500 GB per app AWS WAF is materially cheaper because FortiWeb's $0.40/GB bandwidth line dominates. At 100M req/mo without Bot Control AWS WAF runs ~$75/mo for one app; FortiWeb Cloud at the same workload sits around $250-450/mo depending on egress.
Source: Use the cost calculator on the homepage to model your own workload.
Switching cost
If you are already on one and considering the other
AWS-WAF-to-FortiWeb migrations require pointing the DNS to a FortiWeb-fronted endpoint, re-tuning rules in FortiWeb's rule editor, and re-issuing TLS certs. FortiWeb supports CloudFront origin patterns. Expect 2-4 weeks of work per app. The reverse migration is similar in scope; AWS WAF's managed rule groups have different naming and structure than FortiGuard.
Where to read more
Cross-reference with the pricing-models explainer and the hidden-costs page before signing.
Last verified June 2026