Anti-Cheat Systems Explained: BattlEye, EAC, Vanguard, ACE, FACEIT AC, Ricochet

An anti-cheat is not a single program. It is a stack: a kernel-mode driver, a user-mode service and client library, a server-side analytics pipeline, and a human reviewer at the end. Almost every practical question — why a ban arrives two weeks after the match, why a build breaks on patch day, why the same approach works in one title and dies in another — is answered by knowing which layer is doing the work.

Ring 0 vs user mode

User-mode software runs with the same privileges as your browser. It can enumerate its own memory, ask Windows for a list of processes, and little else that the OS does not hand it voluntarily.

A kernel-mode driver runs at ring 0, the same privilege level as Windows itself. While loaded, it can inspect kernel structures, enumerate loaded drivers, watch memory access, and observe system calls. That is why the industry-wide shift to kernel anti-cheats between roughly 2018 and 2022 changed the landscape so sharply: things that were invisible to a user-mode scanner became routine observations.

The commercial consequence is simple. The lower the anti-cheat runs, the more expensive and more fragile the software that has to coexist with it.

What anti-cheats actually observe

Common ground across vendors, based on their own public descriptions:

• Signatures of known cheat binaries, loaders and code fragments, on disk and in memory.
• Process integrity of the game: patched code, hooked functions, foreign modules, unusual handles opened to the game process.
• Drivers: unsigned, known-vulnerable and known-malicious ones. Vanguard publicly blocks a vulnerable-driver list before the game will start at all.
• Hardware fingerprints used to bind a ban to a machine — see HWID bans.
• Gameplay telemetry: accuracy curves, snap speed, reaction to opponents who were never visible, suspiciously efficient looting and rotations.
• Reports and demos: player complaints plus manual review of recorded matches.

What is not public: the exact data inventories, heuristics and thresholds. None of these vendors publishes detection specifications, and that opacity is deliberate. Treat detailed “here is exactly what X checks” lists as community inference.

BattlEye

One of the oldest commercial anti-cheats, originally a third-party add-on for Battlefield and ArmA. It pairs a kernel driver with a user-mode service and streams detection modules from its servers at runtime, so the checks can change without a game patch. BattlEye has historically stated it can capture screenshots of the game window and send them for review.

Found in: Escape from Tarkov, PUBG, DayZ, Arma, Rainbow Six Siege.

Easy Anti-Cheat

Owned by Epic Games since 2018 and bundled free with Epic Online Services, which is why it is everywhere. Kernel driver plus user-mode component, in two generations: the legacy build and the newer EOS integration. Different games ship different generations, so a build can work in one EAC title and fail in another even though “it is the same anti-cheat.”

Found in: Rust, Apex Legends, Fortnite, Dead by Daylight, SQUAD.

Riot Vanguard

The most aggressive loading model in mainstream gaming: vgk.sys starts with Windows rather than with the game and stays resident the whole session. For Valorant on Windows 11, Riot requires Secure Boot and TPM 2.0. Vanguard blocks known-vulnerable drivers outright, which is why perfectly legitimate overclocking and monitoring utilities sometimes prevent the game from launching. Riot extended Vanguard to League of Legends in 2024.

ACE (Anti-Cheat Expert)

Tencent’s in-house system, shipped in the publisher’s mobile titles and several PC ones, from PUBG Mobile to Delta Force. It includes a kernel component on PC. ACE publishes very little technical material in English: architecture details and its detection surface are not publicly confirmed, and most of what circulates is observation rather than documentation. The practical effect is that build lifetimes in ACE titles are harder to predict than in BattlEye or EAC titles.

FACEIT Anti-cheat

A third-party league client that layers on top of whatever the game already runs. In Counter-Strike 2 that means two independent systems at once: Valve’s VAC and FACEIT AC. It ships a kernel driver, requires Secure Boot and TPM on modern Windows, blocks a range of third-party tools and virtualization, and — importantly — bans a platform profile rather than a game account.

Ricochet

Activision’s Call of Duty anti-cheat, announced in 2021. It combines a PC kernel driver with server-side mitigations that Activision describes openly: a suspected cheater may have their damage nullified, other players hidden from them, or their weapons removed instead of being banned immediately. It is a rare case of a vendor publicly admitting to soft sanctions before the ban, and a useful reminder that strange in-game behaviour is not always a bug.

Summary table

What this means before you buy

1. The anti-cheat decides the catalogue. Vanguard and FACEIT titles simply have fewer working builds and higher prices. That is difficulty, not markup.
2. Anti-cheat updates hurt more than game updates. A game patch breaks offsets and is usually fixed within hours or days; an anti-cheat update can break the whole approach and takes far longer.
3. A quiet week proves nothing. Server-side systems accumulate evidence and act in batches — see why cheats get detected.
4. The risk is never zero. Any seller promising that an anti-cheat “cannot see” a product is selling wording, not software.

Next, read internal vs external cheats, the second factor that decides what is even possible in a given title, and the build selection checklist.