Most advice about staying undetected is folklore, because most people have never been told what the software is actually doing. Here is the shape of it, without the marketing.
Three things anti-cheat looks for
Signature detection asks: have I seen this exact code before? It scans running processes, loaded modules and file hashes against a list of known cheats. It is fast, cheap and completely defeated by changing the code — which is why providers rebuild after every detection wave.
Behavioural detection asks: does this player move like a human? Aim that snaps within one frame, crosshairs that track a target through a wall, reaction times below what a nervous system can produce. This does not care what software you run, only what results it produces.
Integrity checks ask: has the game been tampered with? Memory that changed when it shouldn't, functions redirected somewhere unexpected, a debugger attached. This is what catches internal cheats specifically.
The important consequence: changing your cheat defeats the first, not the second or third. A provider can push an update that clears signature detection while leaving you just as visible to the other two.
Kernel-level anti-cheat, and why it changed things
Vanguard, and increasingly EAC and BattlEye, run in the kernel — the most privileged part of the operating system. Software running in user space cannot hide from software running in the kernel, in the same way a tenant cannot hide a room from the person who owns the building.
This is why the cheat market moved towards external and DMA approaches. If you cannot win a fight inside the operating system, the answer is to not be inside it.
Vanguard also loads at boot rather than at game launch, which closes the window where you could start something before the anti-cheat was watching. Anyone telling you to 'launch the cheat first' is describing a technique that stopped working years ago.
Why bans arrive in waves
Detection and banning are deliberately separated. When an anti-cheat identifies a new cheat it often does nothing visible for days or weeks, quietly flagging accounts, and then bans everyone at once.
The reason is economic. Banning immediately tells the cheat developer exactly which build was caught and how quickly, so they can iterate. Waiting, then banning thousands at once, means the developer learns about the detection at the same moment their entire customer base does.
For you this means the most dangerous assumption in this hobby is 'it worked yesterday, so it is safe'. You are never observing whether you are detected. You are observing whether they have decided to act yet.
It also means a status page that flips a product to detected is often reporting the wave, not predicting it. The accounts are usually already flagged.
What actually reduces your risk
Use an account you can afford to lose. Everything else on this list is a marginal improvement; this one is the difference between an inconvenience and a real loss.
Prefer external over internal where the feature set allows. Fewer integrity checks apply to a process that never touches the game's memory space from the inside.
Keep your visible behaviour ordinary. Behavioural detection and human reports both key off the same thing — play that does not look like play. Losing fights on purpose sounds absurd until you compare the cost.
Do not stack tools from different providers without checking compatibility. A spoofer that conflicts with a cheat's own protection can leave traces that neither would produce alone.
Check status immediately before you launch, not last night. Detection status is a moment-in-time claim and it goes stale in hours.
Frequently asked questions
Can anti-cheat see my whole computer?
Kernel-level anti-cheat has the access to do far more than it typically chooses to. In practice these systems scan memory, processes, drivers and loaded modules relevant to the game. The privilege level is real, and it is a reasonable thing to weigh before installing one.
Does a VPN help avoid detection?
No. Detection is based on what is running on your machine and how you play, not where your traffic comes from. A VPN changes neither.
Is a paid cheat safer than a free one?
Usually, but not because of the price. Paid providers have a commercial reason to keep their product undetected and to warn you when it is not. Free cheats are frequently public, which means already in every signature database, and are a common way to get malware.
Why did I get banned when the status said undetected?
Because detection and banning are separated by design. The flag on your account can precede the ban by weeks, and status pages report the wave once it is visible. No status page can promise you were not already caught.
Check before you buy
Live detection status for every product is on the status page, updated automatically from our supplier feed rather than by hand.
Every product page shows its own live status.
