Faceit Anti-Cheat is a fundamentally different problem to VAC. Valve's stack mostly watches from the server and scans from user space. Faceit ships a signed kernel driver that loads when your computer boots, and over the last two years it has pushed most of its defence down into hardware — Secure Boot, TPM 2.0, IOMMU and VBS are now entry requirements, not suggestions.
If you only play Premier and matchmaking, none of this applies to you. If you queue on Faceit, all of it does, and the requirements have to be satisfied before the platform will let you into a match at all.
The three parts
Faceit describes its anti-cheat as three components, and that framing is accurate:
- A client application that must be running whenever you play a protected Counter-Strike 2 match.
- A kernel-mode driver, loaded at PC boot rather than at game launch.
- A server-side SDK that secures communication between client and server, confirming your anti-cheat is genuinely running during the match.
The boot-time loading is the important detail. By being present before most of the system initialises, the driver can assert that the machine reached a trusted state, rather than trying to work out after the fact whether something got there first.
What the driver watches
Academic work examining kernel-level anti-cheat systems has documented the FACEIT.sys driver's behaviour in reasonable detail. It registers callbacks on image loading, process creation and thread creation, so it sees modules being loaded and processes starting in something close to real time.
Beyond observation, it acts. The driver has detection and unloading capability for known-vulnerable signed drivers — the standard route for getting kernel-level code execution without having a signed driver of your own. It also locates and closes open handles to the protected game process, so nothing else can sit there reading memory. And it refuses to run in virtualised environments, blocking execution with Hyper-V enabled and requiring users to disable it explicitly.
The hardware requirements, and why they landed
Faceit rolled out Secure Boot and TPM 2.0 first, then finalised the set with IOMMU and VBS. Four acronyms, but each one closes a specific attack.
Secure Boot and TPM 2.0
Secure Boot ensures the code running during startup is signed and unmodified, which blocks bootkits that would otherwise load before any anti-cheat. TPM 2.0 provides a hardware root of trust that can attest to the boot state. Together they let Faceit make a claim it previously could not: this machine started clean.
IOMMU
This is the one that changed the market. IOMMU puts hardware devices into address-translation mode — each device gets its own memory window and physically cannot read beyond it. Windows exposes this as Kernel DMA Protection, which blocks devices whose drivers do not support DMA remapping, particularly those connected before sign-in or while the screen is locked.
DMA cheats work by having a second machine, with a capture card, read the gaming PC's memory directly over PCIe — completely outside anything software on the gaming PC can observe. For years that was regarded as unbeatable, because in a sense it was: you cannot detect a reader that never touches the operating system. IOMMU does not detect it. It makes the read fail.
VBS
Virtualisation-Based Security is what makes the IOMMU requirement trustworthy. A security decision based only on a value reported by the normal OS environment is a value that can be spoofed. Putting the enforcement behind the hypervisor means faking it requires compromising the hypervisor first. VBS is the guarantee that the IOMMU check means what it says.
Faceit's own framing of the strategy is blunt, and it is correct: the platform stopped fighting cheats at the software layer alone and moved the check onto hardware. The DMA class that looked untouchable for years stopped paying off once that shipped.
Human Input Detection
The newest layer went live on 5 August 2026 alongside Season 9, and it is the one to watch.
Human Input Detection is machine learning applied to in-game inputs. It reads your inputs in real time from the start of a match to the end, and it is trained to distinguish human play from machine input — learning continuously from Faceit matches and from the highest-ranked CS players. When it sees movement no human could realistically produce, it flags it.
The significance is that it does not care what software you are running. It judges how you play, which means it can catch cheats it has never encountered. Faceit says it proved especially effective in testing against AI-driven cheats, one of the faster-growing categories.
For scale, Faceit reported that AI and DMA cheats together accounted for 40 percent of cheating bans in May 2026. Human Input Detection was built to widen coverage past those into the subtle and the unknown. The platform is also explicit that flags are weighed against other anti-cheat signals before action is taken, and that bans are not always issued the instant a cheat is confirmed — they batch them.
What it adds up to
Faceit in 2026 is a genuinely hard environment, and the difficulty is layered so that beating one layer does not help much with the next:
- Secure Boot and TPM close the pre-boot window.
- The kernel driver closes the software window, including vulnerable-driver abuse and handle access.
- IOMMU and VBS close the hardware window that DMA relied on.
- Human Input Detection closes the behavioural window, regardless of how the cheat is implemented.
Anyone selling you a guaranteed Faceit-proof product is not describing this stack. The honest position is that undetected status on Faceit is a snapshot with a date attached, and the only thing a provider genuinely controls is how quickly they pull a build offline and tell you when something changes.
For the Valve side of the picture — signature scanning, Trusted Mode, VACnet and mid-match enforcement through VAC Live — see our breakdown of what anti-cheat CS2 uses.