"Just use a better anti-cheat" is the most common fix suggested for WARDOGS, and according to Bulkhead it misses the point. The studio says it works with three anti-cheat providers. What actually decides a ban is the evidence behind it: replays of your matches, your raw mouse input set against what the server saw, and a case file that grows each time something does not add up.
This guide pulls together what Bulkhead has said about how that works. Most of it comes from the Road to Season 3 devlog on 6 November 2026 and its Hotzone podcast episode on anti-cheat four days later, which went further than any studio in the genre usually does.
| At a glance | |
|---|---|
| Accounts banned in the November wave | 185,000+ |
| Share of players flagged, worldwide | 4.89% |
| Gameplay analysed to build the models | 187 million hours |
| Session replays available since | About the start of Season 2 |
| Trust score | Planned for 2027 |
It starts with what a normal player looks like
Bulkhead could not catch cheaters well until it knew what legitimate play looks like. That is why it says Season 1 felt so lenient. The studio expected about 1 million sales and two years of data. It got nearly 4 million players in roughly 60 days, and used them as its baseline: 187 million hours of play, analysed with machine learning and AI-assisted tools (Confirmed).
Season 1 ended with about 10,000 bans, which Bulkhead admits was low. It says it held back because it was nervous about banning legitimate players. It also deliberately let cheaters keep refining their tools so its models could watch them change. That patience is why the November wave was so large. A baseline costs months. Bulkhead's bet is that it buys accuracy.
Every match can be replayed
The tool that changed the most is session playback. Bulkhead says it can watch back any player's session, and has been able to since about the start of Season 2 (Confirmed). On the podcast it gave the tool a joke code name and showed how the team uses it.
When a detection rule is ready, the team runs it as a simulated ban first. Nobody is banned; the rule just lists who it would catch. Then the team watches those players' replays and checks whether every one of them is cheating. A rule goes live only when the list holds up. Bulkhead puts its confidence on these bans in the 99.8th to 99.9th percentile.
Your mouse is checked against the server
The core check is whether your hands and the game agree. Bulkhead says it reads mouse input at hardware level and lays it over its own server data, which records when it thinks you landed a hit or got a kill (Confirmed). A triggerbot fires at the instant a target crosses the crosshair, not when a human finger reacts. An aim lock moves the view in a way the physical mouse did not. When the hardware input and the server record disagree, that goes on file.
The same comparison exposes the tools that hide behind something innocent. The team went through one case on air: a player insisted he only used an auto clicker in his Razer software to join teams quickly. His data showed a triggerbot. As the team put it, a mouse that stays perfectly on a player in a helicopter moving at full speed is not an auto clicker.
It also explains why Bulkhead is moving work off the client. In Season 1 it ran more on players' PCs to save server costs, and admits that was a mistake that cheaters exploited. Anything the server decides, the server can check.
Accuracy history gives cheaters away
Cheaters learned to look human. Their history did not. Early in Season 1, some cheaters hit 80% headshots. After the first bans they turned their cheats down. Bulkhead says most now sit between 24% and 36%, while the best players it has watched on Twitch sit around 12% (Confirmed).
What dialling down cannot hide is the record. Bulkhead says it can look back through an account's history and see a player who was blatant early on and gradually tuned a cheat to look plausible. A single good match proves nothing. A run of matches far beyond the best players in the game, following a period of obvious cheating, is a pattern.
Real players do not move like this
The replays let the team ask a simpler question: would a person do that? Bulkhead's examples (Confirmed):
- Reloading while facing a wall. A real player turns to watch an entrance while they reload. A wallhacker already knows nobody is coming.
- Running into the open straight after a kill, because they can see nobody else is near.
- Tracking through cover. Soft aim locks drift towards a player behind three buildings, or jump from a car to its driver.
- Pre-firing into the ground just before an enemy crests a hill they cannot have seen yet.
- Testing whether a bullet goes through a wall by aiming exactly at a head on the other side.
The team plays shooters too, and says that after watching dozens of legitimate replays the cheaters stand out quickly. WARDOGS being a sandbox helps. A player using an aim cheat who tries a mortar cheat as well leaves evidence in two places.
Bans come from a case file, not one flag
Bulkhead builds a "rap sheet" on each suspect. One barely plausible moment is not enough. The same barely plausible moment fifteen times is. A case can combine a hardware-input mismatch, an accuracy spike, a burst of player reports and a replay that looks wrong (Confirmed).
Player reports never ban anyone directly, but they do flag a player for review. Bulkhead calls them one of the most important things players can do. It also says its systems would show if something legitimate were tripping them. When a common network card left the factory without the unique ID it should have had, a batch of wrong bans followed. Bulkhead's point is that a fault like that shows up straight away, because it hits many players at once, not a few in a thousand.
Will you get flagged by accident?
This is the part legitimate players care about. On Bulkhead's account:
| Thing you might use | What Bulkhead says |
|---|---|
| Mouse with extra buttons or vendor software | Fine on its own. Millions of players use them, and a false pattern would show up across all of them |
| Auto clicker, for example to grab a team slot | Detected and recorded, not banned on its own. Next to other suspicious signals it can tip a case. Do not use one |
| Recoil macro | Counts as cheating. The devlog names recoil aids as bannable |
| Flight stick | Bulkhead says it can tell which devices you use and knows a flight stick when it sees one |
| Cheats on an alt account | Traced by hardware ID, and the main account is banned too |
The written rules on Bulkhead's enforcement page are stricter than the auto-clicker answer: they still list macros as bannable. The safe reading is to treat any input automation as a risk. The full macro rules →
Why switching anti-cheat would not fix it
Steam's store page has listed Easy Anti-Cheat, and players have also seen Elytra Anti-Cheat in the launcher. Bulkhead says it uses three main providers and did not name them on the podcast. Its point is that players who blame the choice of provider would find just as many cheaters in games using the alternatives.
Hardware lockdown is not a cure either. Bulkhead says about 80% of the cheats it sees get past TPM and Secure Boot, and that forcing Valorant-level requirements on everyone would cost it about 60% of its players. Its answer is the planned trust score: optional security settings and an optional ID check raise your score, and server admins choose the minimum they accept. How the trust score would work →
What Bulkhead says it cannot do
It cannot end cheating, and it says so. Finding a hole is easier than patching every one, and the studio says cheat makers already use AI to write aim hacks and mortar tools faster. Expect cheaters after every wave, then another wave. What you can do is report suspicious players, because reports are what put them in front of the replay tool. If you were caught in the wave and think it was wrong, here is how to appeal, and here is what else the podcast covered.
