Embark Studios has abandoned its anti-cheat strategy focused on protecting game files, shifting its center of gravity toward player telemetry analysis. Speaking on "Anti Cheat at Embark Studios" at devcom in Germany on August 24, Embark Studios Senior Software Engineer Tom van Dijck detailed three years of trial and error since establishing the studio's anti-cheat team in 2022.

Van Dijck has worked in game engines, systems, and animation for 26 years, with stints at EA DICE, Blizzard Entertainment, EA, and Sony before joining Embark in 2019. For the past three years, he has led anti-cheat development for THE FINALS and ARC Raiders. Embark operates two live-service shooters with a staff of roughly 350.

The Era of "Downloaded Cheat Programs" Is Over

Van Dijck began by addressing how cheats have evolved. "In the early days, people thought of cheating as downloading and running a small program, but over the past few years, that has fundamentally changed," he said.

First, operating systems offer little help. Windows grants developers extensive access to inspect and modify internal program behavior, and cheat creators exploit those same mechanisms. Legitimate software—such as the Steam Overlay, streaming tools like OBS, or Overwolf, which displays overlay windows over games—interjects into games in ways indistinguishable from cheats. Because both inject external code during runtime to intercept visuals and data, telling legitimate tools apart from cheats is extremely difficult.

Linux presents an even worse situation. Because users can custom-build the OS kernel, embedding a cheat directly into the kernel and compiling it makes it nearly impossible for a game to detect its existence. "How do you detect that?" van Dijck asked, adding that while support for SteamOS and Proton will remain, platform requirements will become stricter.

Hardware-based cheats are also growing cheaper. The talk highlighted $5–$6 Arduino boards as an example: connected to a PC disguised as a mouse, they send manipulated movement signals to function as an aimbot. Van Dijck also pointed to a $27 input-manipulation device for consoles and Direct Memory Access (DMA) cards that read and write directly to system memory from a secondary PC. Because DMA cards connect independently and bypass the CPU, the game has virtually no way to monitor them.

Regarding a setup where a small computer attaches to a RAM slot extender to tamper with memory, van Dijck remarked, "From the CPU's perspective, you can't even see what's happening." He also mentioned monitors equipped with built-in AI that draw character outlines on screen: "Most were disabled following backlash from the industry, but the capability remains, and ultimately someone will recreate it."

AI-assisted cheats are particularly troublesome because they do not modify the game executable. By continuously capturing the screen, identifying enemies through specific pixel colors, and sending mouse inputs via an external device, they operate entirely outside the game client, placing them beyond the reach of traditional detection methods. Van Dijck estimated the cheat industry's value at $8 billion, noting that "some commercial cheat vendors operate like full corporations, complete with employees and dedicated customer support teams."

Community Sentiment Is Also an Anti-Cheat Battleground

Van Dijck highlighted public sentiment as a challenge on par with technical hurdles. Once a bypass is discovered, new cheats spread across YouTube, Reddit, and Discord within days, while cheat forums share instructions on how to handle detections and file ban appeals. Cheaters even advise one another to "post on community forums claiming the anti-cheat is broken and that they were falsely banned," he explained.

During the presentation, he shared two redacted Discord screenshots. In one, a user admitted to an acquaintance that they had been caught and needed to find another method; in another forum of 60,000 to 70,000 members, the same individual claimed they were falsely banned. "If the same claim is repeated enough times, media outlets pick it up, leading to articles claiming we falsely banned thousands of players," van Dijck said. "In reality, it's simply not true."

Embark's policy is not to refute individual claims publicly. Reading directly from a prepared statement, van Dijck said, "Experience has taught us that arguing with users in public forums is an endless, thankless task. Instead, we choose to broadly communicate how confident we are in our solutions."

Forking the Compiler and Disguising Unreal Engine

When the anti-cheat team was formed in 2022, the initial approach focused on third-party product integration. Since the studio used Unreal Engine and Epic Online Services, it integrated Easy Anti-Cheat. However, van Dijck noted that "there is no out-of-the-box integration in the engine, so it had to be implemented manually every time," offering to share their know-how with interested developers.

The second phase involved introducing anti-tamper technology to prevent reverse-engineering of the game executable. Anti-tamper encrypts executable files to obstruct structural analysis. Drawing on his experience working with Digital.ai products during his time at Blizzard, van Dijck sought out similar software and adopted a tool from the Theia family.

He explained that this product operates differently from standard anti-tamper tools. Most solutions encrypt files only on disk and decrypt them fully upon execution. In contrast, this tool decrypts only the specific code segment currently executing and re-encrypts it immediately afterward, leaving the file encrypted even within system memory.

Asked about the performance overhead, he explained that the CPU repeatedly decrypts locked regions in 4 KB blocks: "It's hard to give an exact figure, but we estimate it at around 1%." He added that this results in significantly less performance impact than traditional obfuscation tools.

The third step was stripping the "fingerprints" left in the executable. Games built with Unreal Engine yield largely similar compilation outputs. As a result, cheat developers routinely share information on where camera or player coordinates sit in memory, or what code patterns can be used to call internal game functions.

Embark forked LLVM—the compiler infrastructure that translates code into machine instructions—and altered the instruction ordering and memory alignment. This produced a binary structure unique to their games. The memory layout changes with every build and is re-scrambled with each three-week patch cycle.

The area receiving the most effort was making the game "use Unreal Engine without looking like Unreal in memory." Public GitHub repositories host automated tools that extract internal structures from Unreal games; when a new title launches, cheat authors quickly adapt existing tools by swapping a few offsets. Embark downloaded these tools themselves and modified the engine so that the extractors fail to function.

Van Dijck provided specific examples. Unreal Engine leaves metadata describing data names and locations directly inside the executable, allowing cheat developers to map out internal structures without even launching the game. To counter techniques that search for specific code signatures to invoke game functions arbitrarily, Embark implemented checks to verify whether calls originate from inside the game. If the caller resides outside the game's code space, it is flagged as external intervention.

He advised against using standard AES for content encryption. Because the code patterns for widely used algorithms are well known, attackers can set breakpoints at those locations to extract the decryption key and unlock all game assets. While Embark regularly rotates both the keys and the encryption algorithms themselves, cheat creators have still managed to locate them using instruction clusters as clues. "You have to pay attention to even the smallest footprints your code leaves behind," he stressed.

Van Dijck characterized all of these measures as "buying time." He noted, "A sufficiently motivated cheat developer will eventually find a way. Our initial belief that client-side protection would one day eliminate cheating was pure wishful thinking." However, he added that it is not worthless, as it significantly raises the cost of cheat development.

The decision to shift strategies stemmed from deteriorating turnaround times. During the early days of THE FINALS, Embark issued patches every two weeks, but the time required for cheat makers to bypass them grew progressively shorter. While Embark ran out of engine modifications that wouldn't break the game, cheat developers only needed to re-verify specific locations. "Continuing this cat-and-mouse game would require thousands of engineers," he said. "When a single game faces 30 different cheats, blocking just one is simply unsustainable."

20 Billion Daily Events: Pivoting Hiring to Data Scientists

Embark collects roughly 20 billion events per day across its two titles. Events are log records sent to the server for every in-game action, known as telemetry. About 5% of this telemetry is used for anti-cheat purposes, including sanity checks such as whether a crosshair points toward a wall or at a player behind a wall. The remaining data serves gameplay analytics, such as identifying high-engagement combat zones. "99% of the data is useless," van Dijck noted. "Collecting it isn't the hard part—analyzing it is."

This led to a shift in hiring strategy. "We had focused almost entirely on software engineering, but we had no one who actually understood this data," he recalled. "We completely pivoted our hiring toward data scientists, and today we spend far more effort analyzing data than reverse-engineering programs."

As a concrete example of detection, he cited input signal tracing. By recording the entire pipeline from when mouse buttons and movement signals enter the OS to when the camera moves on screen, anomalies emerge where the camera rotates without corresponding user input—indicating automated aim without human interaction on the mouse.

A graph presented during the talk showed red inputs from an unknown source interspersed between actual mouse movement and click data. "We don't know where it's coming from, but it's entering the game," van Dijck said. "This user was banned, and their appeal was rejected."

He also displayed comparative data for automated recoil compensation scripts. Even cheats that intentionally added artificial jitter to evade detection showed clear divergence in recoil curves when compared to human control. "I'll move past this quickly before someone takes a photo of the screen to tune their script," he joked as he skipped the slide.

Embark is bolstering its data analysis capabilities through external collaborations. Van Dijck mentioned working with Nexon's bot detection team in Korea, stating, "Nexon owns Embark, so we work closely together." He also cited Anybrain as a provider of input data analysis models and noted that collaboration with the AWS GameLift team has begun as well.

The talk featured a video tracking player movement trajectories across a level in ARC Raiders. Segments highlighted in purple indicated points where players fell through the terrain. "This is more an example of finding map geometry flaws than anti-cheat," van Dijck explained, "but wall-clipping movement can be detected in the exact same manner."

Kernel Anti-Cheat and Linux Policy

Kernel-level anti-cheat operates at the innermost layer of the operating system, allowing it to inspect the entire PC. While this offers a broad detection scope, it presents significant privacy and security concerns for users. Introducing this topic as a "controversial slide," van Dijck acknowledged, "It is invasive, and we agree."

However, he argued that it is an unavoidable necessity at present: "Cheat software is already doing the exact same thing, reaching the point where cheaters boot via USB drives to hijack the system before the kernel even loads." He also noted that while Microsoft is enhancing platform security, those measures do not apply to older Windows versions used by many players.

To retain direct ownership of its data, Embark is developing its own kernel-level anti-cheat in partnership with external vendors. Tested over the past few weeks on a small test group in THE FINALS, the studio plans to expand its rollout across Season 12. "We don't want a situation where running our kernel anti-cheat causes player PCs to constantly blue-screen," van Dijck explained, emphasizing a phased expansion to ensure stability. Embark previously deployed its proprietary anti-cheat "Elytra" in an inactive state in THE FINALS Update 11.3.0 on August 4.

Platform trust mechanics were also addressed. Features like Secure Boot, TPM 2.0, HVCI, and IOMMU are hardware-level security functions built into modern PCs. They verify that the boot sequence has not been tampered with, store certificates and encryption keys on dedicated chips, and prevent unauthorized external devices from accessing system memory. When enabled, these features disable kernel cheats targeting boot stages as well as DMA cards. "When these security features are active, the likelihood that a user is legitimate increases significantly, reducing the need for kernel anti-cheat," van Dijck said, noting that Embark is considering making them mandatory requirements.

Linux support will continue, albeit under stricter conditions. Custom user-compiled kernels will be rejected, and where verifiable, the aforementioned hardware security requirements will be enforced. On desktop Linux, Embark may experiment with eBPF—a technology that executes inside an isolated sandbox within the kernel, allowing system activity monitoring without modifying the entire kernel. "Linux users are a minority compared to Windows and console, but we have no intention of dropping support," he said. "The community can likely contribute ideas as well."

Outlining the road ahead, van Dijck cited a combination of rule-based detection and machine learning. While spinbots that rapidly rotate the player's view can be caught with explicit rule checks, subtle aimbots that make micro-adjustments are difficult to distinguish from human control, necessitating trained ML models.

He also noted that AI coding assistants influenced their approach. "Thanks to tools like Claude and Codex, solutions that used to take years can now be built in a short time," van Dijck explained. "The barrier to building custom solutions in-house has dropped significantly."

Concluding his talk, van Dijck outlined Embark's criteria for selecting anti-cheat partners. "Simply receiving judgment verdicts from a commercial product is not enough; we need deep access to the underlying signals," he said. "We do not maintain long-term relationships with partners unwilling to share near-raw data." He added that Embark continues to invest in internal capabilities to avoid vendor lock-in.

Offering advice to studios developing FPS games, he warned, "If you think buying an off-the-shelf product and slapping it on is enough, you won't survive." He added, "Data science remains our biggest challenge going forward. We will focus on expanding our signals, models, and detection algorithms to accelerate the speed at which we detect non-human behavior."

Responding to a Q&A question about whether detections rely on outcome metrics like movement speed or kill streaks, van Dijck stated, "In THE FINALS, player movement, environment destruction, and physics are all handled server-side, making movement speed hacks impossible. ARC Raiders also validates movement on the server." Because the server calculates positions rather than relying on player PCs, manipulating the client does not change the outcome.

Camera perspectives, however, present a different issue. Cheats were identified that push the camera forward while leaving the character stationary to peek around corners. Embark addresses this by measuring the distance between the camera and the character, blocking access if it exceeds valid thresholds. "When you have enough data, outliers stand out much more clearly," he noted.

Asked whether they reverse-engineer cheaters from death patterns, van Dijck replied, "It's an interesting approach, but as far as I know, we aren't doing that." Instead, Embark builds models by gathering player positions, opponent positions, and aim angles across a window of 75 frames before and after a kill. He added that which factors the model weights most heavily fell outside his expertise.

On the current results of the pivot to data analysis, van Dijck offered a reserved response: "I would say we are learning a lot." Collaborating with experienced teams like AWS and Anybrain has provided key insights into where to focus their efforts. "We are identifying many cheaters, and on the day of this talk alone, we banned 15,000 players," he shared.

When asked why player data outside a client's line of sight is transmitted to user PCs, he pointed to server costs. Withholding unseen player positions entirely would neutralize wallhacks, but requires the server to compute line-of-sight checks continuously. "In THE FINALS, a single server handles 12 players and occupies one core in a data center," van Dijck explained, noting that as concurrent player counts grow, server counts and costs scale proportionally. He also mentioned that Unreal Engine does not offer selective network occlusion out of the box, requiring custom implementation: "I understand there is a team working on this issue for ARC Raiders."