Thales launches Imperva for Google Cloud in controlled availability

Thales has introduced Imperva for Google Cloud, now in controlled availability.

The product is designed to run within Google Cloud and protect web applications and application programming interfaces using Google Cloud Service Extension traffic. It is intended to let customers keep existing pipelines, integrations and monitoring workflows in place.

The launch addresses a common issue for companies moving more workloads to cloud platforms. Development teams often prefer native cloud services because they simplify operations, while some security products depend on external routing that can add latency and add operational overhead.

Native cloud security tools can also leave gaps for businesses running critical applications. That has created tension between development and security teams, especially where companies want tighter controls without changing how applications are deployed.

Cloud Integration

Imperva for Google Cloud integrates with Google Cloud Load Balancing through Private Service Connect. This allows traffic to stay within Google Cloud's network while it is inspected.

The setup is designed to avoid changes to domain name system settings, secure sockets layer management and application architecture. The product is also intended to provide protection from the outset, with policies updated daily by a threat research team.

Thales says the service has a resilient architecture with no single point of failure and is designed to keep applications available during disruption. Deployment is managed through application programming interfaces and supports Terraform for DevOps workflows.

Those features place the product in a market where security suppliers are trying to align more closely with cloud providers' infrastructure. Buyers have increasingly pushed vendors to reduce the complexity of separate security stacks, particularly in environments spanning multiple teams and rapid software release cycles.

For Thales, the launch also extends the Imperva application security business it acquired in recent years into a more tightly integrated cloud format. Application and API security has become a major area of spending as companies face a broader mix of web threats, bot traffic and attacks aimed at software interfaces rather than only traditional websites.

Tim Chang, Global Vice President and General Manager, Imperva Application Security at Thales, outlined the company's position on that trade-off.

“Organisations shouldn't have to choose between performance, simplicity, and protection,” said Tim Chang, Global Vice President and General Manager, Imperva Application Security at Thales. “With Imperva for Google Cloud, security is part of the cloud infrastructure, delivering enterprise-grade protection without disrupting how applications are built and delivered.”

Google Relationship

The announcement also highlights the broader relationship between Thales and Google Cloud. Thales says it has won a 2026 Google Cloud Partner of the Year Award in the Infrastructure Modernization: Sovereign Cloud category.

That recognition points to another area of overlap between the two companies: digital sovereignty. Regulated sectors in particular have been looking for ways to move systems into hybrid and multi-cloud environments without losing control over data location, encryption arrangements and compliance processes.

Thales has built much of its cloud security business around that demand, including data protection and key management offerings. The new Imperva service adds an application security layer to that portfolio within Google Cloud's environment.

The French group operates across defence, aerospace and cyber and digital markets, and employs more than 85,000 people in 65 countries. In 2025, it generated sales of €22.1 billion and allocates €4.5 billion a year to research and development in areas including artificial intelligence, cybersecurity, quantum and cloud technologies.

The release of Imperva for Google Cloud underlines how large security suppliers are adapting products to run inside hyperscale cloud infrastructure rather than alongside it. The commercial test will be whether customers see enough value in integrated deployment to switch from stand-alone web application and API protection tools already in use.