https://cybertoolchain.io/tools/castle New releases and features in Castle, tracked by The Cyber Toolchain. en Thu, 22 Oct 2026 00:00:00 GMT https://docs.castle.io/changelog/identify-ai-agents-in-your-traffic https://docs.castle.io/changelog/identify-ai-agents-in-your-traffic Thu, 22 Oct 2026 00:00:00 GMT Castle now identifies AI agents and browser automation tools in traffic, returning name, operator, category, and detection method.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a new top-level object in Castle's response identifying AI agents and browser automation tools, including the agent's name, operator, category, and how it was identified.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports detection via verified Web Bot Auth signatures for AI agent identification. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/sdks-page https://docs.castle.io/changelog/sdks-page Tue, 01 Sep 2026 00:00:00 GMT Castle adds an SDKs page giving a single view of SDK integration versions and update status. • New SDKs page provides a centralized view of all SDK integrations, showing which are outdated so teams can quickly identify where to upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://reference.castle.io/v1/api.json https://reference.castle.io/v1/api.json Wed, 05 Aug 2026 11:24:32 GMT API surface changed: +2 endpoints, 2 modified • New endpoint GET /ips/downloads/{dataset}/{window}.{format}.gz • New endpoint HEAD /ips/downloads/{dataset}/{window}.{format}.gz • GET /ips/{value}: response schema changed • POST /ips/query: request body changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://reference.castle.io/v1/api.json https://reference.castle.io/v1/api.json Sun, 02 Aug 2026 10:47:35 GMT Castle now publishes an API — 25 endpoints across 6 areas: List Items, Lists, Privacy, … • List Items (8 endpoints) — List Items represents entries in a List. • Lists (6 endpoints) — Lists represents a generic collection of items, such as Users, IPs, Transactions or any custom property. • Privacy (4 endpoints) — APIs intended to help adhere to GDPR Compliance and specifically assist in supporting Article 15: Right of access by the data subject and Article 17: Right to be forgotten. • Events (3 endpoints) — Castle Events APIs allow you to query and aggregate Events that have been sent to the Castle Risk Assessment APIs. • IP Intelligence (2 endpoints) — Look up Castle's IP intelligence data (address metadata + tunnel observations) for a single IP or a batch. • Risk Assessment (2 endpoints) — Castle Risk Assessment APIs will calculate a risk score as well as evaluate policies based on the provided payload. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/detect-vpn-traffic-with-new-ip-intelligence https://docs.castle.io/changelog/detect-vpn-traffic-with-new-ip-intelligence Mon, 27 Jul 2026 16:10:17 GMT Castle adds VPN traffic detection via new IP intelligence signals. • Detects VPN traffic using new IP intelligence, extending existing tunnel and residential proxy detection capabilities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/detect-residential-proxies-with-new-ip-intelligence https://docs.castle.io/changelog/detect-residential-proxies-with-new-ip-intelligence Mon, 27 Jul 2026 16:10:17 GMT Castle adds Residential Proxy IP signal and richer IP tunnel intelligence to its IP risk detection. • New Residential Proxy IP signal detects traffic routed through real consumer ISPs, catching proxies invisible to traditional datacenter-based detection. • Expanded IP tunnel intelligence provides richer context alongside existing Proxy IP and Tor IP signals. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/export-team-members-to-csv https://docs.castle.io/changelog/export-team-members-to-csv Mon, 27 Jul 2026 16:10:17 GMT Castle lets you export your team members list to CSV from Team Settings for access reviews and compliance audits. • Export team members list to CSV from the Team Settings page, including name, email, user role, 2FA status, and member-since date. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/new-event-field-emailregistered_domain https://docs.castle.io/changelog/new-event-field-emailregistered_domain Mon, 27 Jul 2026 16:10:17 GMT Castle adds `email.registered_domain` field to collapse subdomain variants for better fraud detection. • Adds `email.registered_domain` event field that strips subdomains down to the registered domain using the public suffix list, making it easier to detect fraud patterns that rotate across subdomains. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/additional-authentication-method-types https://docs.castle.io/changelog/additional-authentication-method-types Thu, 23 Jul 2026 15:49:57 GMT Castle adds Proof-of-Personhood and Payment authentication method types for richer signal classification. • Adds Proof-of-Personhood (`pop`) authentication method type for events verified through PoP providers (e.g., Worldcoin, Humanode, etc.). • Adds Payment authentication method type for events tied to a payment method or provider (e.g., card, bank, wallet variants). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/csv-export-for-lists https://docs.castle.io/changelog/csv-export-for-lists Thu, 23 Jul 2026 15:49:57 GMT Castle Lists can now be exported to CSV, with background processing and email delivery for large datasets. • Adds CSV export for List entries — click Export in the list toolbar to download; large lists run in the background and deliver a link via email. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/dark-mode https://docs.castle.io/changelog/dark-mode Thu, 23 Jul 2026 15:49:57 GMT Castle adds dark mode with automatic system-preference detection and manual Light/Dark/System override. • Adds dark mode support: the interface automatically adapts to the system color scheme, with a manual Light/Dark/System override available in the user menu. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/fraudulent-email-domain-signal https://docs.castle.io/changelog/fraudulent-email-domain-signal Thu, 23 Jul 2026 15:49:57 GMT Castle adds a Fraudulent Email Domain signal to detect domains registered specifically for fraud and bot signups. • New Fraudulent Email Domain signal detects email domains confirmed as actively used in fraud and abuse campaigns, distinct from disposable email services like Mailinator or TempMail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/ios-sdk-400-released https://docs.castle.io/changelog/ios-sdk-400-released Thu, 23 Jul 2026 15:49:57 GMT Castle iOS SDK 4.0.0 adds expanded device signals and SDK protection in a major update. • Collects additional device signals for broader fraud and bot detection coverage. • Adds SDK protection capabilities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/multiple-api-keys https://docs.castle.io/changelog/multiple-api-keys Thu, 23 Jul 2026 15:49:57 GMT Castle now supports multiple API keys per account, enabling zero-downtime key rotation and per-integration secrets on Enterprise plans. • Create multiple Publishable API Keys and API Secrets within a single Castle account. • Rotate or revoke individual keys without disrupting other active integrations. • Label each key by purpose (e.g., Production Web, Mobile iOS) for clear per-integration tracking. • Supports gradual traffic migration: create a new key, shift traffic incrementally, then delete the old one. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/phone-call-detection https://docs.castle.io/changelog/phone-call-detection Thu, 23 Jul 2026 15:49:57 GMT Castle adds phone call detection to catch social engineering attacks during login and transactions. • Detects when a user is on a phone call during sensitive actions (e.g., login, transactions) to identify potential social engineering attacks. • Exposes three new fields for phone call state in Castle events. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/webhook-api-key-selection https://docs.castle.io/changelog/webhook-api-key-selection Thu, 23 Jul 2026 15:49:57 GMT Castle lets you choose which API Secret signs each webhook, enabling independent secret rotation per integration. • Enables per-webhook API Secret selection for signing, so integrations can be isolated and secrets rotated independently (Enterprise plans). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/detect-vpn-traffic-with-new-ip-intelligence https://docs.castle.io/changelog/detect-vpn-traffic-with-new-ip-intelligence Thu, 18 Jun 2026 00:00:00 GMT Castle extends IP intelligence to detect VPN traffic alongside residential proxy detection. • Extends IP tunnel intelligence to identify VPN traffic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/export-team-members-to-csv https://docs.castle.io/changelog/export-team-members-to-csv Fri, 05 Jun 2026 00:00:00 GMT Castle adds CSV export for team members directly from Team settings page. • Adds the ability to export team member data to a CSV file via the 'Team settings' page in the UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/new-event-field-emailregistered_domain https://docs.castle.io/changelog/new-event-field-emailregistered_domain Tue, 02 Jun 2026 00:00:00 GMT Castle adds `email.registered_domain` event field to collapse subdomains for fraud detection • Adds new event field `email.registered_domain` that reduces an email's full domain to its registered part using the public suffix list Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/detect-residential-proxies-with-new-ip-intelligence https://docs.castle.io/changelog/detect-residential-proxies-with-new-ip-intelligence Thu, 28 May 2026 00:00:00 GMT Castle detects residential proxies with new IP signal and richer tunnel intelligence. • Adds Residential Proxy IP signal to flag suspicious activity routed through consumer ISPs • Enriches existing proxy/Tor signals with broader IP tunnel intelligence Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle https://docs.castle.io/changelog/csv-export-for-lists https://docs.castle.io/changelog/csv-export-for-lists Wed, 01 Apr 2026 00:00:00 GMT Adds UI-driven CSV export for Lists with background processing and email notification. • Adds the `Export` button in the list toolbar to download List entries as CSV • Enables background execution for large List exports with email delivery of a download link Full history on Cyber Toolchain: https://cybertoolchain.io/tools/castle