How CS2 cheat detection actually works

You can't prove a wallhack from the scoreboard. You can prove it from the demo — if you know what to measure. This is how demo-based cheat detection works, from raw ticks to a verdict you can replay.

01Suspicion is not evidence

Every CS2 player knows the feeling: the enemy who's always pre-aimed, always wide awake, always one bullet faster. But the feeling is unreliable. Good players look like cheaters from the losing side, and blatant cheaters sometimes have unremarkable scorelines because they're toggling carefully.

The scoreboard can't settle it, because K/D, ADR and rank difference measure outcome, not mechanism. A smurf and a wallhacker can post the same 30-bomb. What separates them is how the kills happened — and that information exists in exactly one place: the demo file.

02The demo file sees everything

A CS2 demo is a complete recording of the match's server state, tick by tick: every player's position, view angles, health, weapon, and crucially the engine's spotted state — which players are visible to which opponents at any moment, and every damage event with timing down to the tick.

That last part matters more than people realize. Because visibility and damage are both timestamped, you can measure things no human spectator can see:

• How many milliseconds passed between an enemy becoming visible to a player and that player landing damage on them.
• Where a player's crosshair was pointing before any enemy was visible to them.
• How a player's aim path behaved in the ticks around each kill — smooth tracking, human correction, or a snap that no mouse produces.

Cheats have to act through the same game state the demo records. That's why demo analysis works: the cheat can hide from your eyes, but not from the timeline.

03Signal one: reaction time has a physical floor

Human reaction to a visual stimulus is bounded by biology. Light hits the retina, the signal travels to the brain, a decision fires, muscles move a mouse. Decades of measurement put typical reactions to a simple visual stimulus around a quarter of a second, with elite esports players reaching roughly 150 milliseconds on their best, simplest responses — and that's for pressing a button, not acquiring a target and landing a headshot.

So the first evidence family is simple to state: measure the spotted-to-damage delay on every kill a player makes, over a whole match and over their history. One fast number means nothing — pre-aiming a known angle legitimately produces near-zero delays, and everyone gets lucky. What can't be explained away is a distribution that keeps producing aimed damage faster than a human nervous system can fire, in situations where the player demonstrably had no prior information.

04Signal two: aiming at people you've never seen

Wallhacks don't speed up your hands — they feed you information you shouldn't have. That's also exactly how you catch them.

Because the demo records the spotted state, an analyzer can ask, at every engagement: what did this player actually know? Had the enemy been visible to them or a teammate? Was there a sound cue — footsteps, a reload, utility? Is this a common pre-aim angle that any experienced player would clear?

Legitimate game sense is predictable: crosshairs settle on standard angles, on positions teammates called, on noise. A wall user's crosshair does something different — it tracks the actual enemy position through geometry, follows a rotation nobody on their team could have seen, or locks a specific off-angle that only makes sense if you can see through the wall. Once is a great read. A pattern of pre-aims that always happen to be right, against information that never existed, is the wallhack's fingerprint.

05Signal three: aim that isn't a human hand

The third family looks at the aim itself. A human mouse movement has texture: overshoot, correction, micro-adjustments, and it degrades under spray. Aim assistance leaves different marks:

• Snap signatures — the crosshair travels to a target in a way that violates how mice accelerate and settle, or the view angle at the moment damage is dealt disagrees with where the player was visibly aiming (the classic "silent aim" tell).
• Impossible consistency — hit rates during full spray, or on just-spotted targets, that sit far outside what the entire population of tracked players produces.

Population context is the key word. "Good aim" is only suspicious relative to what good aim actually looks like across thousands of real matches — which is why an analyzer needs a real player pool to calibrate against, not thresholds someone guessed.

06Calibration: the difference between a detector and a witch hunt

Every number in a detection system must earn its place. Our thresholds are derived from percentiles of the actual tracked player pool — the flagging bar sits where legitimate players, including the very good ones, simply do not go. When the data says a proposed threshold would catch real humans, the threshold loses, not the humans.

Just as important are the false-positive guards. Real example: shotguns break hit-rate math — a single shot fires nine pellets, so "hit rate" for a shotgun-heavy player looks superhuman to a naive model. The fix isn't to shrug; it's to detect shotgun-dominant loadouts and disable the meters the weapon invalidates. Every stat a verdict relies on has to be asked: under what legitimate playstyle does this number lie?

07From signals to verdict

No single signal should convict anyone. A defensible verdict system separates evidence by strength:

• Hard evidence — events that are physically implausible for a human, repeated. Timing below the human floor on aimed damage, with no information source, more than once.
• Soft evidence — patterns that are individually explainable but collectively damning: borderline reaction bands, unexplained pre-aims, outlier consistency. Soft evidence only escalates a verdict when multiple independent families agree.

The output is a per-match and per-player verdict, and — this is the part that keeps the system honest — every verdict links to the evidence clips behind it. Not a score you have to trust: the actual kills, replayable on the 2D radar, with the timing and visibility data on screen. If a verdict can't show you its receipts, it shouldn't exist.

08What demo analysis honestly can't do

Demo-based detection reads behaviour, not memory. It can't see cheat software, can't ban anyone, and it will miss a disciplined cheater who stays inside the human envelope all night (though a cheat constrained to human performance is also doing much less cheating). It complements client-side anti-cheat rather than replacing it — VAC asks "what is running on this machine?", demo analysis asks "was this play humanly possible?"

What it gives you that nothing else does: an evidence-backed answer about a specific opponent, from data you already have, that you can watch with your own eyes instead of taking anyone's word for it.

09Frequently asked questions

Next: new to the numbers behind verdicts and ratings? Read CS2 stats explained — rating, KAST, opening duels and the rest.