VAC (Valve Anti-Cheat) has been around since 2002, and its core architecture hasn't fundamentally changed. Understanding it tells you exactly why external cheats are safe.
What VAC Actually Scans
VAC runs periodic scans in three categories:
- Module scan — lists every DLL loaded into the game process. Any unsigned or unknown module is flagged.
- Memory integrity — hashes critical code sections and compares to known-good values. Modified game code = ban.
- API hook detection — checks if common Windows APIs (Direct3D, OpenGL) have had their function tables redirected.
Crucially, VAC does not monitor other processes. It only looks inside the game's own process space.
Why External Cheats Are Invisible to VAC
An external cheat:
- Runs as a separate process — never appears in the game's module list.
- Uses
ReadProcessMemory, a standard Windows API call — indistinguishable from a debugger or profiler. - Never modifies game memory — writes nothing, so integrity checks pass.
- Renders its overlay in a separate window — no D3D hooks inside the game.
VAC literally cannot see it because it's looking in the wrong place.
What CAN Catch External Cheats
- Overwatch — human reviewers watching your demos. Behavioural, not technical.
- VAC Live (CS2 upgrade) — real-time scan, still process-bound, same blind spot.
- Game Coordinator bans — if you're reported 10+ times in a session.
Bottom Line
Run an external loader, keep settings human-level, and VAC can't touch you. The CS2 build here is fully external and free.
Trust Factor Changes Detection Priority
VAC's actual ban decisions are weighted by Trust Factor, a hidden reputation score attached to every Steam account. Accounts with low Trust Factor — generated by high report counts, new Steam registrations, or a history of prior game bans — are placed into review pools where scans run more frequently and clips are more likely to be escalated to Overwatch. A fresh account with no prior reports sitting in the highest Trust Factor band may go hundreds of hours without a flagged scan even if a detectable module is present, while a legacy account with clean history receives no such leniency. Confirming which pool you sit in is difficult by design; the only reliable signal is match quality, since low-Trust lobbies contain visibly more new accounts and smurfs. Many people overestimate the role of raw detection signatures and underestimate Trust Factor as the actual gate on enforcement, which is why identical software configurations produce different outcomes across accounts.
VAC Live and the 2023 Backlog Purge
Valve shipped VAC Live for CS2 in March 2023, and the change that mattered was not real-time scanning but ban latency. Legacy VAC queued detections for a delayed wave ban, typically every few weeks, so a detected account could keep playing until the wave hit. VAC Live terminates the match in progress, which means a detected account is removed within the same game rather than months later. The purge that followed in 2023 and early 2024 removed around 100,000 accounts in waves tied to CS2 launch, substantially larger than previous CS:GO sweeps. The practical consequence for verification is that a single clean session tells you nothing; detection state changes and trust metrics accumulate over time. Track sessions across several weeks and watch for sudden match terminations on other accounts, which usually precede a wave rather than individualise one.
Verified Boot Breaks Kernel-Level Access
Windows 11 enforces Verified Boot and HVCI by default on supported hardware, and HVCI places the kernel in a Hyper-V virtualised environment that restricts unsigned driver loading. Kernel-level anti-cheats such as Vanguard, Easy Anti-Cheat and BattlEye all depend on a signed driver surviving that boundary. Faceit AC and ESEA both require Secure Boot enabled plus TPM 2.0 on Windows 11 for this reason, and players who disable Secure Boot to load unsigned modules lose access to those platforms entirely. VAC itself remains user-mode and is unaffected, which is why CS2 still launches with HVCI on. Checking your own state is a matter of running System Information and reading Secure Boot State and Virtualisation-based security, or checking msinfo32 for HVCI; a disabled result narrows the anti-cheats you can run but does not alter VAC behaviour. The common error is assuming kernel access grants universal protection, when in practice it only applies to the platforms that mandate it.