IN ACTIVE DEVELOPMENT

Three heads.
Zero blind spots.

Cerberus is a next-generation anti-cheat engine that combines kernel-level protection, behavioral AI, and hardware fingerprinting into a single unified defense layer. No rootkit. No telemetry. No compromise.

v0.4.2.0b Latest stable · May 12, 2026
0
Titles in Beta Testing
0
Threats Blocked
0
Sessions Protected
0
Pentest Scenarios Run
Engine --
Sigs: --
Regions: --/9 online
Last sync: --

The anti-cheat industry is failing

Every major solution on the market today was built to fight yesterday's cheats. Here's what they're missing.

Signature-Only Detection
Reactive • Always Behind

Most anti-cheat solutions rely primarily on signature databases — known cheat hashes that are matched at runtime. This means every new cheat version, every recompile, every obfuscation pass creates a window of zero detection. The cheat ecosystem moves faster than signature updates. Public cheats get caught, but paid providers deliver undetected builds within hours of each database update.

No Hardware-Layer Defense
Blind to Physical Attacks

DMA attack boards, firmware-spoofed devices, and external memory readers operate below the software layer entirely. No amount of kernel scanning can detect a cheat that reads game memory from a second machine over PCIe. This attack surface is growing — DMA hardware is cheaper and more accessible every year, and virtually no anti-cheat currently addresses it.

Privacy vs Protection Tradeoff
Always-On • Intrusive

Some solutions require boot-time kernel drivers that run 24/7 — even when you're not playing. This creates a permanent attack surface on every installed system, breaks third-party software like RGB controllers and overclocking tools, and raises serious privacy concerns. Players shouldn't have to choose between security and system integrity.

Three heads, three layers of defense

Each head of Cerberus guards a different attack surface. Together, they eliminate every blind spot in modern anti-cheat.

01
🛡
Kernel Integrity
Real-time verification of every driver, syscall, and memory permission at ring-0. Catches threats before they execute.
  • Driver integrity verification
  • Code-signing enforcement
  • Memory permission auditing
  • Process protection callbacks
  • Injection attempt interception
  • Real-time integrity scanning
02
🧠
Behavioral AI
Processes thousands of input samples per second to detect patterns no human can replicate — regardless of payload delivery.
  • Inhuman input pattern detection
  • Reaction time statistical analysis
  • Movement pattern classification
  • Payload-agnostic cheat detection
  • Per-player behavioral profiling
  • Real-time ML inference
03
🔍
Hardware Fingerprinting
Scans the PCIe bus, cross-references firmware signatures, and detects the memory access patterns that define DMA attacks.
  • Full PCIe device enumeration
  • Firmware signature cross-referencing
  • Known DMA board detection
  • Anomalous memory access monitoring
  • External read attack identification
  • Firmware spoof detection

System architecture

Cerberus operates across three privilege layers with zero persistent background processes. Each layer feeds into a unified verdict engine.

┌──────────────────────────────┐ GAME RUNTIME Cerberus SDK Attached └──────────┬───────────────────┘ ┌────────────────────┼────────────────────┐ │ │ │ ▼ ▼ ▼ ┌───────────────────┐ ┌──────────────────┐ ┌───────────────────┐ KERNEL INTEGRITY │ │ BEHAVIORAL AI │ │ HARDWARE SCANNER Ring-0 Driver │ │ ML Inference │ │ Device Audit └────────┬──────────┘ └────────┬─────────┘ └────────┬──────────┘ │ │ │ └──────────────────────┼──────────────────────┘ ┌────────────────────────┐ VERDICT ENGINE Cross-layer correlation Confidence scoring └───────────┬────────────┘ ┌────────────┼────────────┐ ▼ ▼ ▼ [ CLEAN ] [ FLAG ] [ BAN ] ┌───────────┴───────────┐ Session ends Clean exit Driver unloads, zero trace └───────────────────────┘
Ring 3 — User Mode

Behavioral analysis engine running ML inference in real-time. Classifies player input patterns with sub-2ms latency and zero impact on frame times.

Ring 0 — Kernel Mode

WHQL-signed minifilter driver for system integrity verification. Loads only when the game launches — unloads on exit with zero residual footprint.

Hardware Layer

Device enumeration and firmware verification on session start. Detects unauthorized hardware and external memory access attacks from secondary machines.

Protection from launch to exit

Continuous monitoring across the entire game session. Loads on launch, scans during play, unloads on exit.

Phase 1 — Game Launch
Pre-Session Scan
  • Hardware device enumeration and verification
  • System integrity baseline established
  • Driver and module integrity verified
  • Signature database synced
  • DRM license validation (if applicable)
Phase 2 — Active Session
Continuous Monitoring
  • Real-time behavioral AI analysis
  • Continuous system integrity verification
  • Hardware anomaly detection
  • Process and memory protection
  • Confidence-based threat scoring
Phase 3 — Detection Event
Evidence Collection & Response
  • Session snapshot captured for review
  • Detection metadata logged (type, confidence, head)
  • Ban callback fired to game server
  • Borderline cases escalated to manual review
  • Webhook event sent to partner dashboard

What sets us apart

Built from the ground up to cover every attack surface — software, behavioral, and hardware — in a single unified solution.

Capability Traditional AC Cerberus
Kernel-level integrity protection
DMA / hardware attack detection
Real-time behavioral AI~
Firmware-level device verification
Zero telemetry / zero PII
Runtime-only (no always-on driver)~
DRM integrity verification
No third-party driver conflicts

Certified hardware support

Cerberus is tested and validated across all major hardware platforms. Zero driver conflicts, zero broken peripherals.

Intel
CPU & Chipset
AMD
CPU & Chipset
NVIDIA
GPU & Drivers
ASUS
Motherboard & RGB
MSI
Motherboard & OC
Gigabyte
Motherboard & RGB
ASRock
Motherboard
Corsair
Peripherals & iCUE
Logitech
Peripherals & GHub
Razer
Peripherals & Synapse
SteelSeries
Peripherals & GG
Samsung
NVMe & Storage

Cerberus never blocks third-party drivers. No broken RGB software, no disabled fan controllers, no forced reboots. Full compatibility with HVCI, Secure Boot, and Windows 11 kernel-mode hardware-enforced stack protection.

Watch Cerberus in action

Simulated detection scenarios running against real cheat signatures. Select a scenario and watch the three heads respond in real time.

cerberus v0.4.2.0b — session monitor
KERNEL ACTIVE
AI ENGINE IDLE
HW SCAN CLEAR
VERDICT ---
LATENCY 0.0ms
Select a scenario

Built for competitive framerates

Cerberus was engineered to be invisible to performance. Every scan, every inference, every check — under budget.

96.2%
Overall Detection Rate
Blended across all cheat categories
0.012%
False Positive Rate
Borderline cases escalate to manual review
<0.4%
CPU Overhead
Avg across all layers
<3ms
Scan Latency
Per detection cycle
22MB
Memory Footprint
Total runtime allocation
0
Frame Impact
Measured at 240fps

Detection Coverage

Internal benchmark results from controlled pentest environments. Exact rates vary by cheat category and are continuously improving.

Known Signatures Hash-matched binaries, public cheat DBs
99.1%
Internal Cheats DLL injection, manual mapping, shellcode
97.4%
External Overlays Screen readers, pixel bots, GDI hooks
95.8%
Kernel Exploits Ring-0 rootkits, DKOM, callback removal
93.6%
DMA / Hardware PCIe devices, firmware-spoofed hardware
91.2%
DRM Tampering License bypass, binary patching, loader mods
94.6%
Auto-ban (>95%)
Flagged + secondary scan
Escalated to manual review
v0.4.2.0b · Internal pentest data

Protection that scales with you

From indie studios to AAA publishers. Every tier includes zero telemetry, runtime-only activation, and clean session exits.

Starter
Argus
Kernel-level protection for indie studios and early-access titles. Up to 10K CCU.
Free
Self-service — limited to indie & early-access
  • Kernel integrity monitoring
  • Signature-based cheat detection
  • Memory permission auditing
  • Code-signing enforcement
  • Basic driver verification
  • Standard ban API
  • Community support + docs
  • 10K concurrent player limit
  • Behavioral AI engine
  • Hardware fingerprinting
  • DMA attack detection
  • Dedicated support
Start Free
Professional
Aegis
Full AI-powered behavioral detection for competitive titles. Up to 100K CCU.
Contact Sales
Volume-based pricing — tailored to your CCU
  • Everything in Argus
  • Behavioral AI engine (full)
  • Aim analysis & reaction timing
  • Input cadence anomaly detection
  • Micro-movement pattern recognition
  • ONNX Runtime inference (<2ms)
  • Advanced ban API + webhooks
  • Priority email support (12hr SLA)
  • Monthly threat intelligence reports
  • 100K concurrent player limit
  • Hardware fingerprinting
  • DMA attack detection
Request Access
Enterprise
Olympus
Custom-engineered protection for AAA publishers and live-service titles at any scale.
Custom
Volume pricing negotiated per title
  • Everything in Cerberus
  • Unlimited CCU — no player cap
  • Custom detection rule authoring
  • Private threat intelligence feed
  • On-premise deployment option
  • Custom AI model training on your data
  • Dedicated red team penetration testing
  • White-glove integration onboarding
  • 24/7 engineering escalation hotline
  • SLA-backed uptime guarantee (99.99%)
  • Quarterly executive security briefings
Contact Sales

All plans include zero telemetry collection, runtime-only activation, clean session exits, and full SDK access. Volume discounts available for multi-title licenses. CCU = Concurrent Users. Prices shown in USD — auto-detected by region.

75+
Engineers building the future of game security
Kernel Engineers ML Researchers Threat Analysts Firmware Specialists Game Security Experts SDK Engineers QA & Red Team
Meet the Team

Common questions

No. The kernel driver loads only when your game launches and unloads when it exits. Cerberus has zero presence on the system outside of active game sessions. No boot-time driver, no background processes, no tray icon.

Detections below 95% confidence are never auto-banned — they enter the manual review queue. A threat analyst reviews the full session replay within 4 hours (Cerberus tier SLA). If a ban is issued and appealed, review completes within 24 hours. Current false positive rate: 0.012%.

Zero PII. Cerberus processes hardware IDs, input patterns, and memory state locally on the player's machine. Only detection events (ban/flag) with anonymized session metadata are sent to the API. We don't track playtime, game history, browsing, or anything outside the active session.

The driver requires ring-0 access to monitor memory permissions, detect mapped drivers, and enumerate PCIe devices. It's Microsoft WHQL-signed and undergoes third-party security audits quarterly. The driver uses ObRegisterCallbacks for process protection — it cannot read or modify game memory itself.

Under 30 minutes for Unreal Engine and Unity with our plugins. The raw C++ SDK is 4 API calls: Init, StartSession, EndSession, Shutdown. Full integration guide is available in our documentation.

The driver binary uses multiple layers of code protection and integrity verification. Critical detection logic runs server-side and is never exposed to client machines. We rotate protection schemes with each update.

Yes. Cerberus includes DRM integrity verification as part of the pre-session scan. It detects binary patching, license bypass attempts, loader modifications, and tampered game executables. This works alongside your existing DRM solution (Denuvo, Steam DRM, etc.) as an additional layer of protection.

On detection, Cerberus captures a session snapshot including the detection type, confidence score, which detection head triggered, and anonymized session metadata. This evidence package is sent to the partner dashboard for review. High-confidence detections trigger an immediate ban callback to your game server. All data is retained for appeal review.

Windows 10 20H2+ or Windows 11 (x64). Secure Boot must be enabled in BIOS for full hardware verification. TPM 2.0 is recommended but optional. Players should keep Windows and GPU drivers up to date. No special BIOS configuration beyond Secure Boot is required.

The kernel driver is WHQL-signed and tested across 12+ motherboard vendors and all major CPU/GPU combinations. If the driver fails to load for any reason, the game continues with graceful degradation — it never forces a crash. In 8 months of beta testing, we've had zero BSOD reports.

Players can submit ban appeals through your game's support flow. Appeals go to our threat analyst team who review the full detection evidence, session snapshot, and hardware fingerprint. Cerberus tier partners get 4-hour appeal SLA. If a ban is determined to be a false positive, the player is unbanned and the detection model is updated to prevent recurrence.

Ready to secure
your game?

Cerberus is currently in closed early access. Request access for your studio.

Cerberus is in active development. Features and specifications are subject to change.