The CS2 cheating ecosystem has split into three distinct tiers. At the bottom: free scripts you download from a forum and run with one click. At the top: hardware-level rigs that no software anti-cheat can detect. Understanding the spectrum is essential for anyone trying to think clearly about anti-cheat.
Tier 1: external (user-mode) cheats
An external cheat is a separate process running on the same Windows machine as CS2. It reads the game's memory using ReadProcessMemory Win32 calls and renders an overlay on top of the game window — typically with DirectX or via a transparent borderless window. ESP boxes, radar overlays, and crosshair indicators live in this tier.
External cheats are cheap to develop and trivial to detect. Any user-mode anti-cheat can enumerate processes, hash their binaries, and check for known signatures. VAC catches public externals within days of release. They survive only as long as their signature stays unpublished, which for free cheats is hours; for paid externals, weeks.
Telltale signs in a demo: ESP-style cheats produce radar-styletracking — the suspect's crosshair tracks enemies through walls because their overlay is showing them where the enemy is.
Tier 2: internal (injected) cheats
An internal cheat injects directly into the CS2 process. It runs in the same address space as the game, which means it can read any memory the game can read and call any function the game can call. Internals can do everything externals do, plus they can modify game state — disabling recoil, increasing weapon damage, freezing animations for spinbots.
Internals are riskier for the cheater. The injection itself is a detectable event, and once injected, the cheat lives inside the process VAC is scanning. Modern internals use code obfuscation (virtualisation, packing) and inject through legitimate-looking modules to evade detection. They're harder to write but more powerful.
Spinbot cheats — players whose models spin at impossible angular velocity to evade backstab while still aiming — are an internal cheat signature. Externals can't do that because they can't modify what the game sends to other players.
Tier 3: kernel-mode cheats
Kernel-mode cheats install a Windows driver. From kernel space they can read game memory without any user-mode tracing, hide their presence from process enumeration, and operate below the visibility of any user-mode anti-cheat — including VAC.
FACEIT's anti-cheat and Riot's Vanguard counter this by running their own kernel drivers, creating a kernel-vs-kernel arms race. Valve has resisted that approach because installing a kernel driver into 50 million Steam users' machines is a level of trust escalation Valve is unwilling to ask for.
Kernel cheats require Windows administrator rights to install, which means cheaters running on a competition rig (LAN qualifier, organised league) can usually be filtered by checking driver signatures. In the wild, on home rigs, they're common at the elite tier.
Tier 4: DMA hardware cheats
DMA is the new frontier and the reason anti-cheat conversations have become more pessimistic in 2025-2026.
A DMA cheat consists of two computers. The gaming PC runs CS2 normally with no cheat software installed. A second machine (often a small dedicated SBC) is connected to the gaming PC's PCIe bus through a card like a Squirrel or PCILeech. From PCIe, the second machine can issue direct memory accessreads against the gaming PC's RAM, bypassing the CPU and the operating system entirely.
From CS2's perspective, no cheat exists. From VAC's perspective, the gaming PC is clean. The cheat lives entirely on the secondary machine, which displays an ESP overlay on a dedicated monitor next to the player.
DMA rigs cost between €300 and €800 to assemble. They're not casual-tier cheats, but they're no longer rare. Discord servers selling pre-built rigs ship hundreds of units a month. Detection requires either kernel-side memory access tracing — which VAC doesn't do — or behavioural analysis at scale.
Tier 5: AI vision cheats
The newest tier uses computer vision running on a separate machine. The setup captures the gaming PC's screen output (HDMI capture card → second PC), runs an object detection model trained on CS2 player models, and outputs micro-mouse movements via a Raspberry Pi Pico configured as a USB HID device.
From the gaming PC's perspective: it's receiving USB input. From CS2's perspective: a human is moving the mouse and clicking. There is no cheat process to scan, no memory to inspect, no driver to fingerprint.
AI vision cheats are detectable only by behavioural fingerprinting at the server level — which is exactly what Valve's machine learning trust-factor system is attempting. Whether it succeeds is an empirical question that won't be settled for several years.
What this means for trust factor
Valve's trust factor is a black-box score that determines who you queue with. It is not anti-cheat — it is anti-cheating. The distinction matters. Trust factor doesn't try to ban cheaters; it tries to keep cheaters in matches with each other and away from honest players.
Inputs to trust factor (per Valve's patent filings and public talks) include: Steam account age, total Steam game library, hours played, prime status, friend network behavioural patterns, report rate received, and reports filed. The model is a deep classifier that produces an opaque per-player score adjusted continuously.
Trust factor is the most effective tool currently available against the modern cheat ecosystem precisely because it doesn't care how someone is cheating. It only needs the population of cheaters to behave statistically differently from non-cheaters. They do.
Where community oversight fits
Every detection layer above is reactive. They catch cheaters after the cheating has happened. They cannot give you the satisfaction of a verdict, the closure of knowing the player who ruined your match faced consequences.
That's the gap CSWatch fills. We are not faster than VAC. We are not more sophisticated than trust factor. What we provide is a public, accountable record: names, demos, verdicts, and consensus. When someone cheats and gets convicted by community review, that conviction is visible to everyone who looks the player up before queueing with them.
It's an imperfect layer. So is every other one.