Current release: 9.4.0

This article covers what's new, fixed, and changed in release 9.4 of Cequence App and API Protection (AAP). Release 9.4 delivers control over the AI agents that call your applications, Ask Cequence, an AI assistant built into the console, a unified API inventory, a rebuilt API definitions experience, clearer reporting of bot mitigation outcomes, geo-based mitigation, and Biometric Challenge support for single-page and mobile apps. Read the Breaking changes and Upgrading to release 9.4 sections before you upgrade. Release 9.4 requires Cequence Defender release 6.5 or later.

Release highlights

The AAP 9.4 release concentrates on AI agent visibility and control, AI-assisted operations, API inventory and definition management, and bot mitigation reporting and control.

Agent Trust

The Agents page now labels each AI agent by type, shows the agent's threat activity, behaviors, and issuer, and expands to show detection details. One-click mitigation applies a Block, Rate limit, or Insert header policy to an agent, for all applications or for selected application tags, and the policy can be saved as disabled. Agent access policies for registered agents can no longer match every host and every path.

Ask Cequence AI assistant (Beta)

Ask Cequence is an AI assistant in the console that answers questions about API Security and Bot Management from your tenant data, and proposes configuration changes that take effect only after you approve them. Ask Cequence acts with your permissions and records changes in Audit Logs as AI-assisted. Ask Cequence replaces the API Security Assistant and is available for SaaS deployments.

Unified API inventory

The Endpoints page now shows the visibility, risk posture, and threat activity of each endpoint on one row, including traffic, error rate, threats and the action taken, and AI agent traffic. Summary tiles filter the table by source type, risk posture, and threat protection status, and a new endpoint details view presents each endpoint on separate tabs.

API definition management

The Definitions page is rebuilt. You can edit definitions in place, add shadow endpoints to a definition, and import, download, or delete many definitions at once. Every change is recorded in the definition's history.

Mitigated and Flagged reporting

Bot mitigation outcomes are now reported in two categories across the Summary page, the Detection and Mitigation dashboards, Bot Policies, and the redesigned Application Bot Protection Summary Report.

Geo-based mitigation

Mitigation policies support a Geo Location criterion that matches the client IP address by country, organization, or autonomous system number (ASN), starting with the first request from any IP address. Geo Location criteria require Cequence Defender release 6.5 or later.

Biometric Challenge enhancements

Biometric Challenge now covers single-page applications and native iOS and Android apps. Challenge pages can be published in 13 languages, and a Custom HTML template enables you to use your own branded HTML and CSS.

Other new features and improvements

The following features and improvements are also included in this release.

Added recognition of more AI agents, including coding agents, AI search crawlers, and AI browsing assistants, and of agentic and MCP client traffic. The risk rules catalog moves to version 25, which adds AI agent traffic rules.

Added detections for requests whose browser fetch metadata or user-agent client hints do not match a real browser, and expert rules for recently disclosed PHP session upload-progress and malformed session cookie attacks.

Added an enable and disable toggle and an Edit action to the policy details panel of the Mitigation dashboard. You can also go directly from Mitigation Preview to Policy Details.

Added a Detection Highlights banner to the pivot details of the Threat Protection Detection dashboard, which summarizes the strongest signals behind a detection. The Detection and Mitigation dashboards now open with the first tile selected.

Redesigned the Risk Rules page, which now pins enabled categories at the top and sorts and groups categories alphabetically. Rule names no longer include category and framework references, because a rule can apply to several frameworks. Risk posture, evidence, and reports now show only the rule categories that you have enabled.

The API Security Summary Report now shows trends over time and tracks how issues are opened and resolved over the reporting period.

Restored long-term retention of issues and issue evidence.

The spec viewer now supports OpenAPI Specification 3.2.

Added a certificate swap option for live Edge Network deployments, and the ability to delete pending Edge Network and External CDN deployments that you manage.

The Helm chart no longer contains static passwords, and the telemetry export configuration now accepts an existing Kubernetes secret. Elasticsearch now uses a higher-compression index codec by default for high-volume indices, which reduces storage use.

Updated the bundled API Spyder portal to release 8.3.4 and fury-runner to release 1.7.4.

API Testing can now create or update a test plan automatically from a specification upload and return the test plan ID.

Breaking changes

Review the following changes before you upgrade to release 9.4.

Behavior change: Mitigated counts. The Mitigated count now includes only requests that Cequence Defender stopped. Requests that a policy allowed or tagged now count as Flagged. Mitigated counts on dashboards, policy lists, and reports can be lower than in earlier releases for the same traffic. Your protection has not changed. The sum of Mitigated and Flagged equals the earlier Mitigated total.

Behavior change: endpoint counts. Endpoints are now tracked for each method, host, and path. The same path served on several hosts now appears as separate endpoints, so endpoint counts in the inventory can increase after the upgrade.

Behavior change: one challenge template. Release 9.4 supports one challenge template for each installation, because Cequence Defender serves one challenge page. A Custom HTML template replaces the Simple template instead of existing beside the Simple template. When an environment has more than one challenge template at upgrade time, the upgrade keeps one template and deletes the others. The upgrade keeps the template that the most policies use. When no policy uses a template, or two templates have equal use, the upgrade keeps the oldest template. Every policy that used a deleted template is updated to use the remaining template.

Behavior change: mitigation policy priority validation. The mitigation policy editor now rejects a priority from 200,000,000 to 210,000,000, which is reserved for agent access policies. Use 1 to 199,999,999 for a bot mitigation policy, or 210,000,001 or higher for a WAF policy. The check also applies when you edit an existing policy. When an existing mitigation policy has a priority in the reserved range, change the priority to a value outside the range before you save the policy.

Behavior change: Ask Cequence replaces the API Security Assistant. SaaS tenants that use the API Security Assistant get Ask Cequence when the tenant is upgraded to release 9.4.

Upgrading to release 9.4

Review the following requirements and changes before you upgrade to release 9.4.

Defender compatibility. Release 9.4 requires Cequence Defender release 6.5 or later, for both ARM and x86 deployments. Earlier Defender releases do not apply capabilities that Defender enforces, such as Geo Location criteria. Upgrade your Defender instances to release 6.5 or later before you upgrade AAP, or together with the AAP upgrade.

Traffic statistics storage change. The traffic-stats component no longer uses persistent volumes. The upgrade recreates the traffic-stats workload automatically.

For upgrade and rollback steps, see the article on upgrading from AAP 9.3.

SaaS-hosted environments are upgraded by Cequence directly and do not require action on your part beyond reviewing the breaking changes above.

Known issues

The following issues and limitations are known in this release.

Deleting API definitions in bulk does not remove the deleted definitions from the API scope of risk rules that include those definitions. Deleting the last definition in a risk rule's included scope widens the rule to all APIs. Review the scope of affected risk rules after a bulk delete.

Bulk upload of API definitions rejects uploads of more than 1,000 individual files, and very large uploads can make the API service restart. Upload large sets of definitions in smaller batches, or as an archive file.

Some actions remain console-only for Ask Cequence in this release, including generating API definitions, deleting mitigation policies and traffic filters, editing or deleting existing configuration objects, and creating ITSM tickets.

Biometric Challenge for an SPA requires the SPA and the API to share a registrable domain, such as app.example.com and api.example.com. Users need a device that supports passkeys with biometric or device unlock. Release 9.4 has no fallback verification method for devices without passkey support.

Some agents on the Agents page, including unclassified agents, do not offer one-click mitigation. Use Mitigation Policies to create a policy for these agents.

Fixed issues

The items below are the customer-facing fixes in release 9.4. Note that customer-reported issues appear in their own category as well as the Customer-reported issues section.

Fixed issues in release 9.4.0

The following issues are fixed in this release.

API discovery and specification management

• Select All on the API inventory endpoints grid now selects the reported number of endpoints.
• Sorting by the Class column now works in the API inventory.
• The Auth Type column in the API inventory now updates after a No Authentication finding resolves automatically.
• Endpoints are now reclassified correctly after you delete an API specification while a classification job is running.
• Endpoints with documented specification drift in traffic now show non-conformances correctly.
• Specification reconciliation now completes for large specifications with 10,000 or more endpoints, and for hosts with more than about 280 specification endpoints.
• Clear risk now reports failed, cancelled, and lost Elasticsearch tasks accurately instead of reporting success.
• Clear risk now removes risk entries and issue evidence for endpoints that are receiving traffic.
• Deleting a specification under live traffic now completes and removes the specification's endpoints promptly.
• Specification deletes now complete reliably when the environment has many daily indices.
• API discovery events that contain fields unknown to the current schema are now processed instead of dropped.
• Improved memory use of sitemap discovery.

Risk detection and analytics

• Issue evidence now matches the request that contributed to the risk.
• Risk evidence with an incomplete response body no longer causes a JSON parsing error.
• The Informational risk level filter and column sorting now work.
• Risk rule categories that you turn on now stay on after Elasticsearch initialization runs, for example during an upgrade.

Bot management and user interface

• The status code filter on the Detection dashboard now works.
• The Detection dashboard traffic trend chart now shows a tooltip for every line.
• The User Agent filter no longer splits user agent strings at commas.
• The Clear link now clears Include and Exclude App Tag filters.
• The Include and Exclude App Tag dropdown labels on the Transactions page now display in full.
• The header checkbox in the Rules table now deselects all rows when some rows are selected.
• Pagination and the controls above the list now stay visible on Threat Protection Rules tables at laptop screen sizes.
• Custom time ranges now pass the correct time values.
• AAP now prevents the creation of more than one Descope biometric issuer.

Platform and infrastructure

• CEQASP-13772: The API Security Service indicator on the Diagnostics panel now reports the correct status.
• Component configurations can now be created in parallel without a race condition.
• Component Configuration, BFF, and Traffic Metrics now start when the Elasticsearch cluster health is red.
• Reduced CPU use of application tag matching in Resource Discovery and Traffic Stats.
• Improved BFF responsiveness by removing blocking calls to Keycloak.
• The Airflow API user now receives the permissions that the telemetry export job requires after installation.
• The distribution service now labels response content encoding correctly.

Customer-reported issues

• CEQASP-13772: The API Security Service indicator on the Diagnostics panel now reports the correct status.