How Does VAC Work in 2026?
Valve Anti-Cheat (VAC) is Valve's user-mode anti-cheat shipped with all major Source-engine titles — CS2, Dota 2, TF2 — plus VACnet, the ML behavioral system. VAC runs entirely in user mode (no kernel driver), performs in-process signature scanning, hashes loaded modules, monitors for known cheat process names and DLLs, and queues delayed wave bans. VACnet adds server-side ML analysis of CS2 demo files for aim and wallhack pattern detection. VAC is among the weakest first-party kernel ACs.
VAC has been around since 2002, making it the oldest production consumer anti-cheat. It''s also the only AAA AC that has stayed user-mode in the kernel-mode era. The result is that VAC is structurally outclassed by Vanguard, EAC, and BattlEye on detection — and Valve''s response has been to lean increasingly on VACnet, the ML behavioral overlay, rather than ship a kernel driver.
User-mode, not kernel-mode
VAC runs as part of the Steam client and the protected game process. It does not load a kernel driver. This is a deliberate Valve decision — Gabe Newell and CS leadership have publicly stated that they consider kernel anti-cheat the wrong architectural choice for the Steam platform''s breadth and that they prefer server-side detection. The technical consequence is real: VAC has limited visibility into what other processes on the system are doing, restricted by Windows user-mode access controls. A kernel-mode cheat with proper hiding is structurally invisible to VAC unless it leaves traces inside the protected game process.
What VAC scans
VAC performs: signature scanning of process memory inside the game; hash-checking of loaded modules; monitoring for known cheat-related window titles, DLL names, and process names; behavioral monitoring of certain function calls inside the game (cf. older "VAC2" and "VAC3" lineages reverse-engineered by the community for over a decade); and queue-based delayed banning so wave bans land in batches.
VACnet — the ML overlay
VACnet is Valve''s server-side ML system, trained on labeled cases of confirmed cheaters in CS:GO and now CS2. It analyzes demo files post-game, looking for aim patterns (flick consistency, target-acquisition statistics), wallhack patterns (pre-aiming through walls, view-angle correlations with hidden enemy positions), and cumulative behavioral anomalies. Valve has spoken publicly about VACnet performance — it has become the dominant detection layer for CS2 cheating in 2026, with VAC itself functioning more as the legacy signature-scan backstop.
Where VAC fails
VAC misses: any properly hidden kernel-driver cheat; external DMA setups (until the cheat leaves traces VAC can see); cheats run via separate machine with hardware input replay; humanized cheats that don''t trigger VACnet''s ML threshold. The cheat-development pattern for VAC titles has been "build something that doesn''t touch what VAC scans, and tune what VACnet might see." Compared to the Vanguard / EAC / BattlEye stack, VAC''s technical bar is meaningfully lower.
CS2 ban patterns in 2026
CS2 bans land in two patterns: instant VAC bans (where the in-process signature scan caught a known-bad module) and delayed VACnet wave bans (where ML analysis confirmed cheating across multiple matches). Valve does not publish aggregate ban totals, but community trackers indicate consistent weekly wave activity. Account-level Steam bans are permanent and apply to the account, not the hardware — VAC does not maintain a hardware ban list comparable to Vanguard or BattlEye.
What this means for cheating
CS2 is the AAA title with the most permissive AC technical environment relative to its player base size. This has made it disproportionately targeted by cheat developers — and disproportionately ban-wave-prone via VACnet rather than VAC proper. For RawCheats users on Source-engine games, the relevant defenses are: don''t hit VACnet ML on aim or wallhack patterns, use Steam accounts that don''t carry your library investment, and run a HWID spoofer in case Valve ever adds hardware correlation (which they have signaled they will not, but the future is the future).
Forward look
Valve has consistently rejected calls to ship a kernel AC. The CS2 launch in late 2023 maintained the same user-mode architecture. As of mid-2026 there is no public indication of imminent kernel-mode VAC. The trajectory is toward more VACnet investment and possibly some platform-level integration with Steam Family / Steam authentication — not toward a kernel driver. For the cheat industry this makes CS2 a comparatively softer target than Valorant or Fortnite, and that''s reflected in cheat market pricing and availability. Pair with our HWID Spoofer Guide for general account hygiene.
Why VAC stays user-mode
Gabe Newell and the CS2 leadership have stated publicly across multiple interviews and developer commentary that Valve''s position on kernel anti-cheat is essentially "not on our platform." The reasoning is partly technical (kernel-mode AC carries risks that affect non-cheating players, see the CrowdStrike incident), partly philosophical (Steam''s scale means a kernel AC decision affects an enormous user base across many games), and partly practical (Valve''s organizational structure doesn''t prioritize the AC vendor relationship the way Epic or Riot does). The CS2 launch in late 2023 maintained the same user-mode VAC architecture, and there''s no public signal of imminent kernel-mode VAC through mid-2026.
What this means for CS2 cheating in 2026
CS2 has the highest cheating prevalence of any AAA shooter relative to its competitive scene size. The combination of user-mode VAC + relatively loose server-side culling + Faceit (a third-party anti-cheat layer used in competitive matchmaking that does use kernel-mode techniques) creates a bifurcated environment. Matchmaking on Valve servers is the soft target; Faceit-hosted matches are the hard target. The cheat market reflects this — Valve-server-only cheats are cheap and abundant, Faceit-survival cheats are expensive and private. The economic dynamic is the inverse of Valorant''s: where Valorant has one hard AC and a niche expensive cheat market, CS2 has tiered ACs and tiered cheat tiers. See Best CS2 Cheat 2026.
Related Pages
Sources
- VAC FAQ — Valve
- CS2 Updates — Valve
- VACnet Update — Valve
Related Questions
Anti-cheats detect aimbots through three layered techniques: signature scanning (matching cheat binaries and known code patterns in memory), input/behavioral analysis (statistically anomalous mouse movement and reaction time distributions), and server-side validation (replay re-simulation comparing the player's reported view angles against what the demo file shows). Aimbot detection has shifted heavily toward behavioral ML in 2025-2026 — Anybrain, VACnet, Zakynthos, and Riot's ML pipeline are the new battleground.
Behavioral ML detects cheaters by training machine learning models on labeled gameplay data — confirmed cheaters versus legitimate players — and flagging sessions whose input statistics, gameplay patterns, or outcomes are anomalous. Inputs include mouse-movement curves, reaction-time histograms, recoil compensation, view-angle smoothness, kill rates, and headshot percentages. Detection happens server-side, takes hours to days for confident calls, and has been the dominant detection layer for aimbots in 2025-2026 — Anybrain, VACnet, Zakynthos, Defense Matrix.
A kernel-level anti-cheat is anti-cheat software that runs in ring 0 — the same privilege level as the Windows kernel — via a signed driver loaded into the OS. This gives it visibility into all processes, threads, drivers, kernel callbacks, and physical memory on the system. Examples: Easy Anti-Cheat (EAC), BattlEye (BEDaisy.sys), Riot Vanguard (vgk.sys), Activision Ricochet, NeacSafe, Zakynthos. Defense Matrix and VAC are NOT kernel-level — they run in user mode.
Warden is Blizzard's user-mode anti-cheat scanner, in continuous operation since World of Warcraft launch in 2004. It runs in-process inside Blizzard games (WoW, Diablo, StarCraft, Hearthstone, Overwatch, Heroes of the Storm) and the Battle.net launcher. Warden enumerates running processes, hashes loaded modules, scans memory for known cheat patterns, queries window titles and process names, and reports findings to Blizzard servers. It does NOT run in kernel mode — Warden is user-mode and per-process.
