WARDOGS Anti-Cheat Explained: Vendors, Bans, AI

Checked against BULKHEAD's public statements on 2026-11-12. Figures below are the studio's own estimates, not independent measurements.

Quick answer

WARDOGS anti-cheat is not one product. It is three unnamed vendors plus an in-house review pipeline, and the pipeline is where most of the public explanation focuses. BULKHEAD's position is that no single signal decides a ban: hardware attestation, session playback, raw mouse input compared with server-side hits, hit-rate history, player reports and behaviour patterns are assembled into a case file, and the case file is what gets acted on.

Two numbers frame every trade-off in the system. Around 80% of cheats can bypass TPM and Secure Boot checks, so hardware requirements cannot carry the load alone. And enforcing Valorant-level hardware rules would, by BULKHEAD's estimate, lose about 60% of players. Those two figures explain why the design looks layered rather than strict.

Three vendors, no names

BULKHEAD has confirmed that WARDOGS uses three third-party anti-cheat vendors. It has not named them, and it has not said which vendor covers which function. That silence is deliberate, and it is also the reason vendor lists circulating in the community are guesses.

What can be said without guessing: three vendors means three detection surfaces, and it means a ban decision may combine signals from tools that were built by different companies with different false-positive profiles. It also means that a single vendor outage is not the same as anti-cheat being off.

Why hardware checks are not a wall

TPM and Secure Boot raise the cost of certain cheats, particularly ones that need to load a driver or modify the boot chain. They do not inspect what happens inside a running game.

BULKHEAD's estimate is that about 80% of cheats bypass those checks. That number is the reason the studio keeps investing in behavioural detection. If hardware attestation blocked most cheating, the review pipeline would be unnecessary; because it blocks a minority, the pipeline is the actual product.

The trade-off BULKHEAD will not take

The obvious hard-line option is to require the same hardware posture as a competitive shooter with a kernel driver and strict boot rules. BULKHEAD has priced that option: roughly 60% of players would be lost.

That estimate is a business constraint as much as a technical one. A ban system that removes more than half the audience protects a game nobody is left to play. The layered approach is a compromise between coverage and reach, and the studio has been explicit that it chose reach.

Season 1's client-side mistake

During Season 1, part of the verification work ran on the client to save server cost. BULKHEAD has described that as a mistake. Client-side checks run on the machine controlled by the person you are trying to catch, which is the weakest possible place to put them.

The stated fix is migration to server-side processing, so that decisions depend on data the client cannot rewrite. That migration is in progress, not finished. Players should expect the balance between client and server checks to keep shifting between seasons.

How a ban is actually assembled

The design intent is a file, not a tripwire. A single odd match is weak evidence; a match plus an implausible accuracy jump plus behaviour that only makes sense with information the player should not have is a case.

BULKHEAD has also described running simulated bans before rules go live and reviewing the recordings, which is a check against shipping a rule that catches ordinary players.

The numbers behind the model

The public figures are large and worth keeping in proportion:

• 187 million hours of matches processed.
• A machine-learning model used to surface suspicious accounts.
• 4.89% of players have used external modification software at some point, according to BULKHEAD.

The 4.89% figure is a share of a very large base, and it is not the same as a ban rate. Using a modification once and being banned are different outcomes, and the gap between them is exactly what the review pipeline exists to decide.

Where AI is and is not used

AI appears in two places: programming assistance for the development team, and data dashboards for the anti-cheat team. It does not generate art, animation or voice work. BULKHEAD has been explicit about that boundary, and it matters for players worried that the game's content pipeline is being automated.

For anti-cheat, the model surfaces patterns; humans still own the outcome. That is the same split described for reports: automation narrows the pile, people make the call.

Boosting servers and gold farming

Two related problems get handled outside the normal match review. Boosting servers, where accounts are levelled or ranked for payment, and gold-farming operations that move currency between accounts, are treated as organised activity rather than individual cheating.

The stated penalty for the servers involved is a cleanup that revokes in-game currency and the right to host. That is a heavier instrument than a match-level ban because it targets the operation rather than a single account.

What BULKHEAD has not explained

As of 2026-11-12, the public record does not include:

• The three vendors. No names, and no mapping of vendor to function.
• Model features. Which variables the machine-learning model actually weights.
• Signal weighting. How much a report, a playback review or an input anomaly counts toward a decision.
• False-positive rate. No published figure for incorrect bans, only a confidence percentile.
• Appeal route. The current channel for a disputed ban is described inconsistently, so confirm it on the official account page before acting.

Any article that fills those gaps with specifics is guessing, even when the guess sounds technical.

Related guides

• WARDOGS Trust Score: the 2027 plan
• The Hotzone Ep.2 notes
• How to report a player
• WARDOGS community servers
• WARDOGS Season 3