Reading a CS2 Demo: An Overwatch Reviewer's Checklist for Cheat Detection

After 50,000 reviewed cases on CSWatch, our most experienced Overwatch judges converge on roughly the same checklist. It's not magic. Cheaters give themselves away through a small number of high-signal patterns. If you know what to look for, even a 10-minute demo is enough to reach high confidence.

Before you watch: the meta-signals

Open the case page first. Three pieces of context shape the rest of the review.

• Account age and CS2 hours. A 6-month-old account with 70 hours of CS2 and a 2.0 K/D in Premier matches is a smurf at minimum, and probably worse. A 12-year Steam account with 5,000 hours could just be a returning veteran.
• Reporter context.Was this case submitted with a specific timestamp ("watch round 14")? Reporters who tag rounds tend to have spotted something concrete.
• Trust-factor proxies.If CSWatch shows the suspect's friends have a high VAC-density rate, expect the cheating to be more sophisticated. Sophisticated cheaters socialise in clusters.

The 17-point in-demo checklist

Aim and crosshair behavior

1. Pre-aim before sound cue.The single highest-signal tell. If the suspect's crosshair tracks an enemy through a wall beforeany audible step, gun fire, or comms cue, that's a wallhack. Be careful with corners the player has cleared 100 times — habitual angles look like wallhacks but aren't.
2. Snap with no overshoot. Human flicks always overshoot slightly and correct. A perfect terminal snap with zero correction is an aim-bot signature.
3. Multi-target tracking through walls. Crosshair smoothly traversing from one off-screen enemy to another off-screen enemy is the giveaway for radar-style ESP.
4. Locked-on tracking through smoke. Tracking a moving enemy across smoke at constant relative angular velocity is impossible without ESP.
5. Recoil pattern reset. The AK-47 spray pulls down-left then down-right. A player whose crosshair counter-traces the spray perfectly while tracking a moving target is using a no-recoil script.

Movement and reactions

6. Pre-firing "random" angles. Spraying a wall before peeking a head-glitch is a habit; pre-firing a B-site stack on round 4 of a fresh map with no callouts is not.
7. Reaction time below 100ms. Visible reactions to enemies appearing in peripheral vision in under 100ms across multiple instances. Single instances of fast reactions are normal — humans can react in 100-200ms in primed states.
8. Counter-strafing precision. Top players counter-strafe almost perfectly. Always counter-strafing perfectly, including in panic situations and during mid-combat reposition, suggests a movement script.
9. Bhop chains. Three or more perfectly-timed bunny hops in a row, especially on autoexec-binding servers, indicates a hop script.
10. Through-smoke tracking with instant flick reset. Tracking through a smoke and emerging on-target with no settle time is rare for legitimate players but mechanical for cheats.

Decision-making

11. Information they shouldn't have. Pushing into a site with no comms warning, on a round where they have no map intel, and finding the rotated enemy at exactly their angle.
12. Saving when they shouldn't know. Walking awayfrom their planted bomb in the last 3 seconds because the defuser is around the corner they can't see.
13. Sound-cue selectivity. Reacting consistently to silenced or muffled enemies that the audio engine renders below typical hearing threshold.
14. HE grenade timing. Throwing utility into spots that are only occupied based on positions invisible from their viewpoint, repeatedly.

Statistical patterns

15. Headshot ratio above 75%. Aggregated across the demo. Pros run ~50-65%. A consistent 80%+ in a single demo is suspicious; sustained over multiple matches is conclusive.
16. Damage delta vs. teammates. The suspect doing 3-4x the damage of their next teammate, repeatedly across rounds, in a match where ranks should be matched.
17. First-bullet accuracy on long ranges.Ten consecutive deagle headshots at 30m+ from rest position is one cheating signature. Spread over a career it's a pro highlight reel.

Calibrating false positives

This checklist will incorrectly flag genuine pros if you apply it mechanically. The antidote is consistency-checking. A single perfect flick proves nothing. Twelve perfect flicks in a 16-round demo, with no overshoot variance, is conclusive.

The other antidote is listening to the demo. Cheaters often have completely normal comms while their crosshair tells a different story. Pros, on the other hand, comm their reads and explain their angles. The disconnect between comm-content and crosshair-knowledge is the single best heuristic to separate skill from cheating.

How to vote

On CSWatch, your verdict options are guilty, not guilty, and insufficient evidence. The third option exists for a reason: use it. Voting guilty when you're 70% sure isn't justice, it's a coin-flip with someone else's reputation. If the demo doesn't convince you to a level you would accept being judged by, vote insufficient.

Conviction on CSWatch requires 3+ guilty verdicts at 66% consensus. That threshold exists so that an honest 50/50 review doesn't convict anyone. Trust the system to require a confident majority. Your job as a reviewer is to be precisely as confident as the evidence merits — no more.