Cloudbric
South Korean web application firewall and DDoS protection vendor under Penta Security.
On the record
Checkpoint: Cloudbric WAF+ Managed Rules feature update ships, after slipping from Q2
The call
Cloudbric leans on Korean regulatory trust while hyperscalers build cheaper, AI-native WAF tools that could erode its regulated-sector footing over the next two years.
Cloudbric makes security software that stops hackers from attacking websites. Its strength is trust with Korean banks and government agencies that need local compliance. But bigger companies like Cloudflare and Amazon are building similar protection directly into their own services at little extra cost, and those giants are now learning how to meet Korean rules too. The only thing that could save Cloudbric is if Korean regulations stay so strict and local that big foreign companies can't easily comply in the next 1 to 2 years.
Why
01
AI pressure: AWS WAF and Cloudflare ML-based bot/anomaly detection. Hyperscalers now bundle machine-learning WAF and bot detection at near-zero marginal cost, squeezing Cloudbric's managed-rules pricing. Could AI do the core job? Yes, likely.
02
Bigger players: AWS, Cloudflare, Akamai, Fortinet, Imperva. These vendors are working to localize Korean-compliant cloud WAF offerings, which could pull public and financial clients away from Cloudbric within 12 to 24 months. Could a giant copy it? Yes, easily.
03
What protects it. Korean regulatory access through KISA's C-TAS system and local compliance trust keep public and financial-sector clients anchored to Cloudbric for now.
What would change this call
AWS or Cloudflare ships a Korean-compliant, gov/finance-certified WAF offering by late 2026. Hyperscalers are localizing into Cloudbric's regulatory moat and eroding its advantage.
Cloudbric Mask paid API monetization traction or stall reported after its May 2026 launch. Shows whether Cloudbric's new AI-era product line can generate real new revenue.
Named Korean financial or government logos publicly move to AWS WAF or Cloudflare. Would confirm Cloudbric is losing its core regulated-sector customer base.
Cloudbric Mask paid API monetization traction or stall reported after its May 2026 launch. Shows whether Cloudbric's new AI-era product line can generate real new revenue.
Named Korean financial or government logos publicly move to AWS WAF or Cloudflare. Would confirm Cloudbric is losing its core regulated-sector customer base.
Key numbers
- 900+ corporate clients across 150 countries
- 91.53% true-positive rate in Tolly Group WAF test
- Estimated $18 to $18.6M annual revenue
Named risks
- Core WAF rule-writing and anomaly detection increasingly commoditized by hyperscaler-native ML WAFs (AWS, Cloudflare).
- No IPO or acquisition exit path; company remains privately held under Penta Security with no disclosed funding rounds since 2017.
- Inconsistent self-reported customer counts (900+ vs 10,000+ in same period) raise credibility questions on vendor claims.
- Absent from Forrester, SecureIQLab, and PeerSpot leader rankings, signaling limited global market recognition.
- Roadmap slippage seen in Managed Rules feature delayed to Q3 2026 per internal May 2026 report.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| AWS WAF | contesting | Cloudbric became first Korean company in AWS WAF Ready Program and offers AWS WAF Managed Rules, Oct 2023 |
| Cloudflare | losing to | Named a Leader by Forrester Wave Q1 2025; PeerSpot July 2026 shows 5.2% mindshare vs Cloudbric absent from rankings |
| Imperva | losing to | Named Leader by Forrester and SecureIQLab; PeerSpot July 2026 shows 7.7% mindshare, up YoY |
| Akamai | losing to | Named a Leader in Forrester Wave Q1 2025 and SecureIQLab v4.0, unlike Cloudbric |
| Fortinet FortiWeb | losing to | Named a Leader by SecureIQLab; PeerSpot July 2026 shows 4.8% mindshare |
Questions people ask
- Is Cloudbric owned by Penta Security?
- Yes. Cloudbric is a product brand of South Korea's Penta Security Inc, founded 1997 in Seoul. It spun off as an independent startup on December 1, 2017, then merged back into Penta Security Inc around October 2023, per Cloudbric's own merger announcement.
- Is Cloudbric profitable?
- No independently disclosed financials exist since Cloudbric is private. Parent Penta Security's revenue is estimated around $18 to 18.6 million per data aggregators, with Frost and Sullivan citing double-digit YoY growth in 2022 following about 20 percent growth in 2021. No profit figures are disclosed.
- Could AI replace Cloudbric's WAF product?
- Core WAF functions like rule-writing and anomaly detection are increasingly commoditized by ML-driven detection built natively into AWS, Cloudflare, Imperva, and Akamai platforms, per a June 30, 2026 WAAP buyer guide. Cloudbric's differentiation rests on Korea-specific compliance trust rather than unique AI capability.
- Who are Cloudbric's biggest competitors?
- Forrester Wave Q1 2025 and SecureIQLab name Akamai, Cloudflare, Imperva, and Fortinet as WAAP market Leaders, none of which is Cloudbric. Cloudbric is positioned as a Korea/APAC regional challenger, absent from these third-party leader rankings as of mid-2026.
- Did Cloudbric ever have a cryptocurrency token?
- Yes. Cloudbric ran a CLBK token/ICO tied to a blockchain security marketplace starting around 2017 to 2018. As of 2026 the token shows essentially zero trading activity, with 24-hour volume near $4,400 and market cap listed at $0 on CoinGecko.
- What is Cloudbric's main product?
- Cloudbric WAF+ is the flagship cloud-based WAF/WAAP product, launched in 2015 as Korea's first cloud web security SaaS. Version 3.0 relaunched October 22, 2025, positioned around Korea's easing network-separation policy for financial and public-sector cloud migration.
Timeline
- 2026-06-26Cloudbric Mask API launched as standalone AI image/video de-identification service
- 2026-06-04Internal progress report shows WAF+ Phase 1 85% done, Managed Rules delayed to Q3 2026
- 2026-04-22Cloudbric WAF+ ranked number 1 in WAF category on Japan's IT Trend mid-year rankings
- 2025-10-22Cloudbric WAF+ v3.0 relaunched as Korea's First SECaaS Platform Innovation
- 2025-01-15Cloudbric marked 10th anniversary, reporting 900+ corporate clients in 150 countries
- 2024-02-25Tolly Group testing found Cloudbric Rule Set achieved 91.53% true-positive rate vs OWASP Top 10
- 2023-10-31Cloudbric Inc merged back into parent Penta Security Inc
- 2023-10-03Cloudbric became first Korean company validated in AWS WAF Ready Program
- 2017-12-01Cloudbric spun off from Penta Security as independent startup
- 1997-07-21Penta Security Inc founded in Seoul by Seokwoo Lee
Revision history
26 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- Cloudbric 10th anniversary (2025-05-26)
- Cloudbric Launches As An Independent Startup Following Immense Growth in 2017 (2020-03-10)
- Cloudbric, Inc. Merger Announcement (2023-10-31)
- Penta Security Company Profile
- Penta Research - Overview, News & Similar companies (2024-05-15)
- Products, Competitors, Financials... (2025-05-11)
- Cloudbric joins the AWS WAF Service Ready Program... (2023-10-03)
- Penta Security Portfolio Investments... (citing EIN Presswire) (2024-02-25)
- Revenue, Competitors, Alternatives (2022-04-19)
- Penta Security's Cloudbric WAF+ v3.0 (2025-10-22)
- Cloudbric Mask Image De-identification API Service Launch (2026-06-26)
- Cloudbric Services Progress Report (5/1, 5/31) (2026-06-04)