Anti-Cheat Reference
Anti-Cheats Explained — EAC, BattlEye, Ricochet, Vanguard, ACE & FACEIT
Every PC shooter in 2026 ships with a different anti-cheat — and most players have no idea what's actually running on their machine. This is the definitive breakdown: how each anti-cheat works, what it can and can't see, kernel vs user-mode, and the games each one ships with.
- Kernel-level vs user-mode — what's the actual difference
- Easy Anti-Cheat (EAC + EOS) — Fortnite, ARC Raiders, Rust, Fall Guys
- BattlEye — DayZ, Rainbow Six Siege, PUBG
- Ricochet — Call of Duty Warzone & Black Ops 7
- Vanguard — Valorant & League of Legends (always-on driver)
- ACE (AntiCheatExpert) — ARC Raiders, Naraka, Honor of Kings
- FACEIT AC — third-party CS2 / CSGO competitive
- How each one detects DMA, HWID spoofers, kernel drivers and externals
Confirm the current product state before each session.
Eligible orders are delivered through the customer dashboard.
Review platform and hardware requirements before checkout.
Kernel-level vs user-mode — the real difference
A user-mode anti-cheat runs as a normal program with normal permissions. It can scan your game's memory, watch for known cheat DLLs, and report suspicious patterns — but it cannot see the Windows kernel, drivers, or other processes' protected memory. A kernel-level anti-cheat loads a signed Windows driver that runs at Ring 0 — the same privilege level as Windows itself. It can scan every process on your machine, every loaded driver, the BIOS, TPM, and hardware identifiers. EAC, BattlEye, Ricochet, Vanguard, and ACE are all kernel-level. FACEIT AC is the only major one in this list that ships kernel-side optional features. Why this matters: kernel anti-cheats can catch externals and DMA hardware that user-mode anti-cheats physically cannot see. That's why kernel anti-cheat is now the standard — and why bypassing one requires far more work than bypassing the old user-mode generation.
Easy Anti-Cheat (EAC + EAC-EOS)
Owned by Epic Games. The most widely deployed PC anti-cheat — over 150 titles. EAC has two variants in 2026: • Classic EAC — Rust, ARK, Apex Legends (still). Kernel driver + user-mode service. • EAC-EOS (Epic Online Services) — Fortnite, ARC Raiders (partial), Rocket League, Fall Guys. Newer architecture, integrates with the EOS SDK, harder to bypass. What EAC detects: known cheat signatures, suspicious process attachments, modified game files, unsigned drivers, kernel-level injection. What it does NOT do well: detect DMA hardware reading game memory externally, and detect cheats that never touch the game process. Games: Fortnite, Rust, ARK: Survival Evolved/Ascended, Apex Legends, ARC Raiders, Rocket League, Fall Guys, The Finals, Dead by Daylight, Squad.
BattlEye (BE)
The veteran. Around since 2004, kernel-level since 2015. Independent company, contracted per-game. BattlEye is known for aggressive cheat hunting — it employs a dedicated team that reverse-engineers public cheats and bans in waves. What sets BE apart: heuristics + behaviour analysis instead of pure signature matching. BE will let a cheat run for weeks then mass-ban every user in a single sweep. That's why BattlEye bans feel random — they're not. Games: Rainbow Six Siege, DayZ, PUBG, Arma 3, Destiny 2 (alongside BE in some regions), Squad, Star Citizen, Planetside 2.
Ricochet Anti-Cheat
Activision's in-house kernel anti-cheat, launched 2021 for Warzone. Combines a kernel driver with server-side ML — the famous 'Damage Shield' (cheaters' bullets do no damage) and 'Cloaking' (cheaters can't see legitimate players) are Ricochet's server-side tricks. What Ricochet detects: standard kernel-level scans plus server-side behavioural analysis on shot angles, snap speeds, and tracking patterns. Ricochet is updated alongside every COD season patch — that's why cheat providers (including RageByte) pause sales during patches. Games: Call of Duty: Warzone, Modern Warfare III, Black Ops 6, Black Ops 7.
Vanguard
Riot's kernel anti-cheat for Valorant — and now League of Legends. The most controversial of the bunch because Vanguard's driver loads at Windows boot, not at game launch, and stays resident always. What Vanguard detects: kernel-level scanning, TPM 2.0 + Secure Boot enforcement (mandatory), and live driver inspection. Vanguard refuses to run if you have certain debug tools, virtualization features, or test-signed drivers loaded. Games: Valorant, League of Legends, Teamfight Tactics.
ACE (AntiCheatExpert)
Tencent's anti-cheat — kernel-level, originally built for Honor of Kings, now rolled out across Tencent-published shooters. ACE got a huge spike in 2025-26 because of ARC Raiders, which ships ACE alongside EAC-EOS for layered protection. What ACE detects: kernel + server-side, similar to Ricochet's model. ACE has its own driver named ACE-BASE.sys — most ARC Raiders launch errors trace back to this driver. Games: ARC Raiders, Naraka: Bladepoint, Honor of Kings, Delta Force, Apex Legends Mobile (older versions), several Tencent titles.
FACEIT Anti-Cheat
Third-party anti-cheat for competitive CS2 / CSGO and Dota 2 on the FACEIT platform. Separate from VAC. Kernel-level optional modules, mandatory for FACEIT Premium and ECS-level matches. What FACEIT AC detects: deep kernel scans, hardware ID logging (FACEIT HWID bans are real and last forever), screenshot capture, suspicious driver enumeration. FACEIT is the strictest anti-cheat in PC gaming right now — most public CS2 cheats die on FACEIT within days.
What anti-cheats CAN'T see
Even kernel-level anti-cheats have a hard ceiling: they only see what runs on your machine. A DMA card reads game memory over PCIe from a second PC — the anti-cheat never sees a process, driver, or file on the gaming PC. A HWID spoofer changes the hardware fingerprint before the anti-cheat reads it, making bans portable. This is why private paid cheats survive longer than public free ones, and why the cheat market split into 'externals + DMA' vs 'old-school internal injectors'. The anti-cheat side knows this — every kernel AC now does some form of PCIe device enumeration to spot known DMA cards.
Frequently Asked Questions
Review notes and sources
Reviewed by the RageByte product team on . This supporting page is checked against the current product page, checkout options, status information and publisher documentation. Send corrections to [email protected].
Primary reference: Activision RICOCHET overview. Third-party software can violate publisher rules and lead to account or hardware penalties. A status label records a current check, not a guarantee against future detection.
Before checkout, read the refund policy and privacy policy.
Bypass guides per anti-cheat
Deep-dives on bypassing each major kernel anti-cheat.
Pricing, plans and instant key delivery for our private COD build.
Visible check, dynamic FOV, hitbox selection and controller binds for Warzone, BO7 and Zombies.
Boxes, skeleton, snaplines, health, name and a 9-channel color editor.
Dedicated Zombie aimbot and ESP for BO7 round-based Zombies.
Aimbot, ESP, radar and Ricochet bypass for Call of Duty: Warzone.
Silent aim, dynamic FOV and controller binds tuned for Warzone TTK.
Review the current product options
Confirm compatibility, live status and purchase terms before checkout.