Dear Alibaba Cloud user,
Thank you for your continued trust in and support for Alibaba Cloud Web Application Firewall (WAF).
To address the bot risks posed by automated tools, scripts, and intelligent agents, Alibaba Cloud WAF 3.0 will launch Agentic Bot at 08:00 on September 23, 2026, and upgrade the features and billing of the existing bot management module. Please review the following changes and prepare accordingly.
Overview of changes
WAF 3.0 introduces Agentic Bot. Building on existing bot management capabilities, it incorporates AI-powered analysis to enhance bot intent recognition, intelligent scoring, traffic analysis, and attack event analysis.
After the new version is released, the legacy bot management module will enter a maintenance-only period. Existing users of legacy bot management can continue to use it with no changes to its features or billing. You can also upgrade to Agentic Bot based on your business needs. New users who enable bot management can only purchase Agentic Bot.
Feature changes
Agentic Bot (new)
Agentic Bot adds the following core capabilities to bot management:
Intent recognition and intelligent scoring
The legacy bot management module relies on users to manually configure individual detection rules. Agentic Bot introduces an intelligent scoring mechanism that analyzes multi-dimensional signals-including access behavior, request frequency, path, device, and network characteristics-to automatically identify automated access intent and generate a bot score and classification.
Instead of manually combining numerous rules, you only need to configure response policies based on score levels. This greatly simplifies configuration and tuning. Compared to the legacy module's rule-based detection, Agentic Bot achieves a significantly higher detection rate for complex and mutated bot traffic.
Detection results are classified into four categories: Confirmed Bot, Highly Suspected Bot, Suspected Bot, and Normal Request.
Observability and analysis
Agentic Bot provides analytical views for Total Bot Requests, Disposition Results, Traffic Trends, Score Distribution, Top Sources, and Matched Rules. You can view bot traffic distribution by protected object, client type, traffic fingerprint, and request characteristics. You can also check the detection results and disposition information for specific requests in the bot logs.
AI-powered attack event analysis report
The system analyzes bot attack events and logs over time to generate a report summarizing attack conclusions, detection evidence, attack techniques, business impact, and protection effectiveness. You can run reports automatically or on-demand, which allows you to review critical events and adjust your protection policies.
Legacy bot management
Once Agentic Bot is launched, the legacy bot management module will enter a maintenance-only period and will no longer be available for new purchases. Existing users can continue to use the legacy module with no changes to its features or billing, or they can choose to upgrade to Agentic Bot.
Billing changes
Subscription WAF
New users
Starting from 08:00 on September 23, 2026, when you purchase a new WAF 3.0 instance or enable bot management for the first time, only Agentic Bot will be available for purchase; the legacy option will no longer be displayed.
Existing users
Existing subscription users of legacy bot management can continue to use it without any changes to its features or billing. To upgrade and access the new capabilities of Agentic Bot, please contact your account manager.
Agentic Bot pricing
Base fee: The fee is 1,400 USD/month (previously 1,150 USD/month) for Web Protection and 2,140 USD/month (previously 1,750 USD/month) for App Protection. This fee applies to all subscription instance editions.
QPS expansion surcharge: After you enable Agentic Bot, the bot management QPS expansion fee in your original QPS expansion plan is reclassified as the AI module QPS expansion fee. The new unit price is 0.36 USD/QPS/month (previously 0.30 USD/QPS/month). This fee is displayed as a separate line item in your billing details.
Elastic QPS expansion surcharge: After you enable Agentic Bot, the bot management elastic QPS expansion fee in your original elastic QPS expansion plan is reclassified as the AI module elastic QPS expansion fee. The new unit price is 0.018 USD/QPS/day (previously 0.015 USD/QPS/day). This fee is displayed as a separate line item in your billing details.
Pay-as-you-go WAF
New billing unit: Credit
Pay-as-you-go billing for Agentic Bot is based on Credits (100 Credits = 0.2 USD). The rates are as follows:
Web Protection Template Fee: 320 Credits/protection template/hour.
App Protection Template Fee: 500 Credits/protection template/hour.
Request Processing Fee: 1 Credit/1,200 requests/hour.
Advanced Custom Rule Fee: 100 Credits/rule/hour
Account Security Protection Template Fee: 320 Credits/protection template/hour
New users
Starting at 08:00 on September 23, 2026, when you purchase a new WAF 3.0 instance or enable the bot management module, you will only be able to enable Agentic Bot, and the legacy bot management options will no longer be displayed.
Switching for existing users
Pay-as-you-go users of the previous version of Bot Management can continue to use the service without any impact on features or billing. To upgrade to Agentic Bot, go to the Protection Config > Bot Management > Bot Management Template page and click Upgrade to Agentic Bot Management in the upper-right corner. After you upgrade, you will be billed based on Credits.
The switch to Agentic Bot and Credit-based billing is irreversible. You cannot revert to legacy bot management and its original billing method after switching. Before you proceed, please carefully review the feature differences and cost changes. For details, refer to the prompts in the console.
Pay-as-you-go bill composition
After the switch, your pay-as-you-go WAF bill will consist of two parts: a SeCU part and a Credit part.
SeCU part: Covers WAF instance and traffic fees, resource access function fees, web core protection function fees, and fees for other advanced protection features that continue to be billed in SeCU.
Credit part: Covers the following Agentic Bot fees: web/app protection template, request processing, advanced custom rule, and account security protection.
Preparing for the change
Assess the impact: Based on your current bot management usage, evaluate the need for an upgrade and the potential impact on your protection policies and costs.
Understand the new features: Review the new capabilities, applicable scenarios, and billing details of Agentic Bot in the WAF console and documentation.
Plan your upgrade window: Upgrading is not mandatory for existing users of the legacy bot management module. If you require features like intent recognition, intelligent scoring, observability, or the attack event analysis report, you can schedule the upgrade during a suitable time window.
FAQ
Agentic Bot vs. legacy bot management
Legacy bot management primarily uses individual rules for detection, which requires you to manually select and configure them. Agentic Bot uses an intelligent scoring mechanism that combines multi-dimensional signals for a unified decision. This significantly reduces configuration and tuning effort and improves the detection rate for complex and mutated bot traffic. The new version also adds richer traffic analysis views and an AI-powered attack event analysis report.
Will my costs increase after upgrading?
Yes. The overall cost of Agentic Bot is slightly higher than that of legacy bot management. For details, refer to the billing section above.
Is the upgrade mandatory for existing users?
No, the upgrade is not mandatory. Existing users can continue to use legacy bot management without any changes to its features or billing. You can also choose to upgrade to Agentic Bot if your business requires its new features.
Is the upgrade to Credit-based billing reversible?
No. The upgrade to Agentic Bot and Credit-based billing is irreversible. You cannot revert to legacy bot management or the original billing method after the upgrade. Before proceeding, please review all relevant feature and pricing information.