For years, PC anti-cheat was built around a familiar assumption: if a cheat wanted to manipulate a game, it had to interact with the same operating system that was running the game. That gave defenders places to watch, from user-mode processes to kernel drivers, loaded modules, memory edits, suspicious handles, and tampered game files. Direct Memory Access cheating weakens that assumption because the cheating hardware can observe system memory from outside the normal software path, often feeding information to a second machine while leaving far less activity for conventional anti-cheat software to inspect.
That matters most in competitive shooters, where knowledge is often worth as much as mechanical skill. A DMA setup can be used to extract information such as player positions from memory and turn it into an external radar or wallhack-style advantage without injecting the usual cheat code into the protected game process. Riot has described purpose-built PCIe DMA hardware as a persistent cheating vector in VALORANT, while EA reported 1,103 targeted DMA bans in Apex Legends during the first part of Season 28 in 2026. The threat is real enough that major publishers are now treating firmware state, motherboard security, hardware-backed memory isolation, gameplay telemetry, and statistical behavior as parts of the same anti-cheat system.
Why DMA Changes the Detection Problem
DMA exists because high-speed devices need efficient access to memory. GPUs, storage controllers, network devices, and other hardware would perform terribly if every transfer had to be micromanaged by the CPU. A DMA-capable device can therefore move data to and from system memory with limited CPU involvement, which is perfectly legitimate until a hostile device abuses that access.
Traditional anti-cheat systems are strongest when the cheat leaves software evidence on the gaming PC. A suspicious driver can be identified, an injected module can be found, a process can be inspected, and unauthorized changes to protected memory can trigger detections. DMA cheating can move part of that activity onto separate hardware and, in many cases, a second computer. The gaming machine may still be the source of the information, but the analysis and display of that information can happen elsewhere.
This does not make DMA invisible or unbeatable. It changes what evidence is available. Instead of relying only on the presence of a known cheat program, developers can examine whether the PC is running in a trustworthy security state, whether attached hardware is behaving within expected memory boundaries, whether boot protections were bypassed, and whether the player’s actions match information they should reasonably possess.
Riot’s 2026 Vanguard update illustrates how much the problem has shifted. Riot said cheaters were present in about 0.7 percent of PC ranked matches across League of Legends and VALORANT at the time of publication, and its breakdown specifically tracked DMA alongside kernel cheating, tampering, and other vectors. DMA is less useful in a game where the client has little hidden information available, but it becomes much more valuable in a tactical shooter where the client must know enough about nearby opponents to render and simulate the match correctly.
The IOMMU Is Becoming Part of Anti-Cheat
The hardware response to rogue DMA is the Input-Output Memory Management Unit, or IOMMU. In simple terms, the IOMMU sits between DMA-capable devices and physical memory and controls which memory ranges a device is allowed to access. Microsoft describes Windows Kernel DMA Protection as using the IOMMU to restrict peripherals to assigned memory regions when compatible DMA remapping is available.
For anti-cheat developers, that changes the defensive model. A PCIe device no longer has to be treated as if it deserves unrestricted access to physical RAM simply because it is attached to the system. With correct IOMMU configuration and compatible drivers, memory access can be remapped and fenced so a peripheral receives only the portions it legitimately needs.
Riot has been especially aggressive here. Its Vanguard team says it has applied full IOMMU restrictions to high-ranked VALORANT accounts associated with DMA abuse, and its newer optional Vanguard security path asks for Windows 11 25H2, Secure Boot, TPM 2.0, VBS, HVCI, and IOMMU support. These requirements are designed to make the machine prove more about its own integrity rather than asking the anti-cheat to trust every layer beneath it.
There is a compatibility cost. Legitimate hardware can depend on drivers that do not support the required memory remapping behavior, and PC gaming still spans an enormous range of motherboards, BIOS versions, add-in cards, controllers, audio devices, capture gear, and older peripherals. A security policy that blocks every unusual device would reduce cheating, but it would also block honest players. Anti-cheat therefore has to distinguish between a secure baseline and a configuration that is simply uncommon.
Boot Security Matters Before the Game Even Starts
DMA defense gets harder if the system can be compromised before Windows and the anti-cheat are fully active. Riot disclosed in December 2025 that it had found a motherboard firmware problem affecting pre-boot DMA protection across multiple vendors. In affected systems, firmware could indicate that protection was enabled even when the IOMMU had not been initialized correctly during the earliest stage of boot.
That finding explains why Secure Boot, TPM 2.0, VBS, HVCI, BIOS updates, and firmware attestation are showing up more often in competitive game requirements. Each feature covers a different part of the trust chain. Secure Boot helps ensure that approved boot components load, TPM can provide hardware-backed measurements and identity, virtualization-based security can isolate sensitive code and memory, and IOMMU controls can restrict device access to RAM.
Microsoft’s own documentation makes an especially relevant distinction: Windows Kernel DMA Protection operates after the operating system has loaded, while protection against DMA during boot depends on the system firmware. This is why motherboard firmware is now part of the anti-cheat conversation. If the earliest layers of the machine cannot be trusted, a kernel anti-cheat that starts later is already playing from behind.
Call of Duty has moved in the same direction. Black Ops 7 requires TPM 2.0 and Secure Boot on PC, and Team RICOCHET has tied those requirements to a broader system that combines client security, server-side detection, and gameplay analysis. EA has also made Secure Boot a requirement for Battlefield 6 and describes it as an enabler for stronger detection against kernel cheats, memory tampering, spoofing, virtualization abuse, and anti-cheat interference.
Data Can Expose What Hardware Tries to Hide
The most interesting anti-DMA work may happen nowhere near the PCIe bus. Hardware can conceal how information was obtained, but it cannot erase what a player does with that information. A player using an external radar still has to move, pre-aim, rotate, engage, disengage, or position in ways that reflect knowledge of opponents.
That creates a second detection surface based on behavior. Team RICOCHET says its current models examine aiming, movement, reaction times, map activity density, kill and damage patterns, latency anomalies, and team-level statistics. Its replay systems can also assign suspicion scores to captured match data so the most questionable cases rise faster for review.
This approach is especially relevant to DMA wallhacks because the anti-cheat does not have to prove exactly which piece of hardware delivered the hidden information before it can identify abnormal play. If a player repeatedly tracks enemies through opaque geometry, rotates toward unseen threats with improbable consistency, or chooses engagements with information unavailable through normal audio, vision, teammates, or prior contact, the pattern can become statistically unusual even if no cheat process is found.
The hard part is separating cheating from elite play. Veteran competitors routinely prefire common angles, read timing, infer rotations, use sound well, and build strong predictions from incomplete information. A weak behavioral model could punish exactly the people a ranked system is supposed to reward. That is why large datasets, replay review, multiple signals, and conservative enforcement thresholds matter more than any single suspicious clip.
Riot’s account restriction system reflects this probabilistic approach from another direction. Vanguard can place stronger security requirements on accounts or hardware IDs associated with suspicious hardware behavior or statistical anomalies, without claiming that every restricted configuration is itself proof of cheating. The system can demand a more trustworthy environment from riskier cases while avoiding the compatibility damage of forcing the strictest configuration onto every PC immediately.
Anti-Cheat Is Becoming a Layered Trust System
Kernel anti-cheat remains valuable, but DMA has exposed the limits of treating kernel access as the finish line. EA says Javelin operates at kernel level because external cheats and kernel-resident cheats can evade many protections that exist only in user space, yet the company also describes hundreds of specific detections, broader telemetry signals, and preventative controls working together. The direction is clear: no single sensor is expected to carry the entire defense.
The strongest modern systems increasingly combine several categories of evidence. They check the boot chain, inspect the operating environment, verify hardware-backed security features, control device memory access, watch for known cheat components, measure gameplay behavior, analyze replays, compare accounts against population-level patterns, and use server authority to limit how much hidden information reaches the client in the first place.
Server design deserves more attention in this discussion because it can reduce the value of memory theft. If the client never receives information about an opponent, a DMA device cannot extract that information from the client’s RAM. Competitive games cannot always hide everything because clients need enough state to handle rendering, prediction, animation, audio, networking, and fast interactions, but every piece of unnecessary hidden state becomes potential intelligence for a memory-reading cheat.
The result is a defensive strategy based on reducing trust. The operating system does not automatically trust a DMA-capable device, the anti-cheat does not automatically trust the operating system’s reported security state, the server does not automatically trust the client, and the enforcement system does not automatically trust one detection signal. Each layer is checked against another.
The Cost Will Be Felt by Legitimate PC Players Too
Stronger hardware-backed security creates friction, especially for players on older systems. BIOS updates can be intimidating, Secure Boot can expose unsupported configurations, some peripherals lack modern DMA remapping support, and virtualization-based protections can conflict with aging drivers or niche software. Publishers have to decide how much compatibility they are willing to trade for a cleaner competitive environment.
The shift is already visible. Riot now offers an optional path that allows Vanguard’s driver to run only while a Riot game is being played when a machine satisfies stronger Windows and hardware security requirements, while still reserving stricter restrictions for suspicious accounts and configurations. EA and Activision have gone further in specific titles by making Secure Boot mandatory, turning platform security from a recommendation into an entry requirement for competitive PC play.
That tradeoff will probably become sharper as cheat makers move farther away from ordinary software injection. DMA cards, modified input devices, computer-vision systems, firmware abuse, and external processing all push defenders toward evidence that is harder to fake: trusted boot state, isolated memory, verified hardware behavior, server-side limits, and long-term statistical patterns.
The practical anti-DMA battle is therefore moving beyond the question of whether an anti-cheat can find a forbidden program. Developers are trying to prove that the machine started cleanly, that devices cannot freely read protected memory, and that the player’s behavior matches the information the game actually provided. Hardware cheating raises the price of detection, but it also gives anti-cheat teams a reason to connect security engineering with match telemetry in ways that older software-only defenses never had to attempt.