Anti-cheat software
Also known as: anti-cheat, anticheat, anti-cheat system
Anti-cheat software tries to detect and block players using cheats, such as aimbots that aim automatically or 'wallhacks' that reveal hidden opponents, in online games.
Some systems run on game servers; others run on the player's computer, sometimes at the deepest 'kernel' level of the operating system. While strong anti-cheat protects fair play, kernel-level software has the same powerful access that security tools do, so a bug or breach can cause serious harm.
Anti-cheat software, explained at three levels
At home
Anti-cheat software is like a referee who also checks the players' equipment. Cheat programs work by reading the game's memory, for example to find where hidden enemies are, or by sending fake inputs that aim for you. Anti-cheat watches for those programs on your computer and for impossible behaviour in matches, then blocks or bans the accounts that use them.
At work
Anti-cheat software detects and blocks unauthorized programs that give players an unfair advantage in online games, such as aimbots and wallhacks. It combines checks on the player's computer with analysis on the game's servers. Businesses invest in it because cheating drives honest players away, damages a game's reputation, and directly cuts revenue in competitive and free-to-play titles.
At home
Anti-cheat works on a few layers. It checks that game files haven't been modified. It scans your computer's memory for known cheat programs and for other software poking at the game. Servers analyze behaviour, such as aim that snaps to heads too precisely. The deepest versions load a driver into the Windows kernel at startup, so they can spot cheats that hide from normal programs.
At work
Anti-cheat combines client-side and server-side defences. On the client, it verifies file integrity, scans memory for signatures of known cheats, and blocks unauthorized access to the game process, sometimes from a kernel driver. On the server, authoritative design means the server decides hits and movement instead of trusting the client. Statistical and machine learning models flag suspicious play, hardware ID bans block repeat offenders, and delayed ban waves keep cheat makers guessing.
At home
Cheats and anti-cheat compete for the same privilege. If a cheat runs at kernel level, the core of Windows, normal anti-cheat can't see it, so anti-cheat moved into the kernel too. That means a game company's driver has the same control over your PC as Windows itself, and a bug can crash your system. In my opinion, that's a lot of trust to hand a game company, and players should know when they're granting it.
At work
Kernel drivers carry real risk: a faulty one can crash the system, and a vulnerable one can be exploited by malware. They also block Linux and Steam Deck support, and Microsoft is restructuring kernel access after the 2024 CrowdStrike outage. Meanwhile, cheat makers have moved to external hardware, such as DMA cards that read memory directly, and AI vision tools that never touch the game. Server authority and behavioural analysis remain the most durable defences.
Real-world examples
At home
Sophie kept losing to opponents who seemed to know exactly where she was hiding. After a game update added new anti-cheat detection, a ban wave hit hundreds of accounts, and matches felt fair again.
At work
Thomas is a security engineer at a Montreal studio. His team moved key game decisions, like hit detection, to the server and added behaviour analysis, catching cheaters without requiring a kernel driver.
How it compares
| feature | Kernel-level anti-cheat | User-mode anti-cheat | Server-side anti-cheat |
|---|---|---|---|
| Where it runs | Deep in the operating system | Like a normal program | Game servers |
| Detection power | High | Moderate | Behaviour-based |
| Risk to player PCs | Highest | Lower | None |
| Platform compatibility | Often Windows only | Better | Universal |
Deeper anti-cheat sees more, but asks for more trust.
For analysts
Anti-cheat choices affect platform reach and player trust, not just fairness. I'd prioritize server-side protections and be transparent with players about any kernel-level component.
History & origin
Cheating grew with online PC games in the late 1990s. PunkBuster appeared in 2000, and Valve introduced Valve Anti-Cheat (VAC) in 2002 for games like Counter-Strike. Commercial systems such as BattlEye and Easy Anti-Cheat, which Epic acquired in 2018, spread widely. Riot Games launched Vanguard, a kernel-level anti-cheat that starts with Windows, alongside Valorant in 2020, and extended it to League of Legends in 2024. After a faulty CrowdStrike security update crashed millions of Windows PCs in July 2024, Microsoft began working with vendors to move security software out of the kernel, a shift that also affects anti-cheat. Apex Legends dropped support for Linux and Steam Deck in 2024, citing cheating. In my view, anti-cheat is an arms race where players' own computers are the battlefield.