The best anti-cheat detection is not software. It is a human watching a replay. Session replay lets anti-cheat teams see what a player actually did, frame by frame, and catch the cheats that run clean under the detector.
What the software cannot see
Anti-cheat software watches the client: what processes are running, what memory is being read, what the aim is doing. It is good at catching the cheat that touches the machine. It is bad at catching the cheat that does not need to touch it, or that touches it in a way that looks normal. A player using a second PC to read the game state, or an aim assist tuned to look human, or a wallhack that only shows information the player then acts on plausibly, can run clean under the detector for months.
Session replay solves a different problem. It does not ask what the software is doing. It asks what the player did. A replay shows every position, every aim movement, every shot, from the server's point of view. A player who pre-aims at an enemy through a wall, who tracks a target he could not have seen, who snaps to a head through smoke, leaves a pattern in the replay that is visible to a human even when the software missed it.
The distinction matters because the cheats are getting better at looking legitimate to software. The replay is the backstop: the one place where the cheat has to actually play the game, and where playing the game leaves evidence.
How a replay team works
The WARDOGS anti-cheat team behind the extraction shooter HotZone gave the clearest public account of how this works. They reported a ban wave of about 185,000 accounts, roughly 5 percent of the roughly 4 million copies the game has sold, and they said the session replay tool was central to the work. The team does not watch every match. It watches the matches the system flags: players with statistics in the 99.8th or 99.9th percentile, accounts reported by other players, matches where the outcome looks wrong.
The bans come in batches of about 50, and each one is hand-checked by a human before it goes out. That is slow by the standards of automated anti-cheat, and it is the point. A hand-checked ban is a ban the team will defend, and a ban that does not hit innocent players. The team would rather ban 50 cheaters it is sure about than 5,000 it is guessing at.
The 99.8th percentile number is worth sitting with. It means the system flags the top two-tenths of one percent of players by whatever statistic it is watching, and then a human decides whether the numbers mean skill or software. Most of the flagged players are legitimate. The replay is what separates them from the ones who are not.
When a replay changes a tournament
Replay review is not just for ranked play. In November 2026, the VCT disqualified Team BONK and ordered the affected matches replayed after a review found a rules violation. The replay was the evidence, and the decision was made on what the footage showed, not on what the software reported. The matches were replayed, the bracket was re-run, and the tournament continued with the result changed.
That is a different kind of power from a ban wave. A ban wave punishes a player. A replay decision changes a result, and it does it in public, with the footage as the record. The teams that accept the decision accept it because the replay is visible and the reasoning is checkable. The teams that dispute it dispute the interpretation, not the existence of the evidence.
The lesson for competitive integrity is that the software is the first line and the replay is the court. The software catches the obvious. The replay catches the subtle, and it catches it in a way that can be shown to the people affected.
What replay review cannot do
Replay review has limits, and they are the same limits as any human judgment. A skilled cheater can play in a way that looks legitimate on replay, taking care to check corners, to miss shots, to play the information plausibly. A legitimate player can look suspicious in a short clip, especially a player with unusual settings or a playstyle that the reviewer does not recognize.
That is why the teams hand-check in batches and why they use the replay as a second filter rather than a first one. The replay does not replace the software. It catches the cases the software cannot decide, and it does it slowly, one account at a time, with a human making the call. The trade is speed for accuracy, and for the bans that matter most, accuracy is the right trade.
Keep reading
Related guides on this site: how kernel-level anti-cheat actually works how leaver penalties escalate from warnings to season bans how real-money trading gets traced through trade graphs More from Bot Protection For Games.
Frequently asked questions
What is session replay in anti-cheat?
A replay is a recording of the match from the server's point of view, including every player's position, aim, and actions. Anti-cheat teams watch replays to see behavior the software cannot measure, such as pre-aiming at enemies through walls or tracking targets the player could not have seen.
Do anti-cheat teams watch every match?
They do not watch every match. They watch the matches the system flags: players with statistics in the 99.8th or 99.9th percentile, accounts reported by other players, and matches where the outcome looks wrong. The replay is a second filter, not a first one.
How many accounts can replay review actually catch?
The WARDOGS anti-cheat team behind the game HotZone reported a ban wave of about 185,000 accounts, roughly 5 percent of the game's roughly 4 million copies sold, and said the replay tool was central to the work. They ban in batches of about 50, each hand-checked by a human.
Has a replay review ever changed a tournament result?
Yes. In November 2026, the VCT disqualified Team BONK and ordered the matches replayed after a replay review found a rules violation. The replay was the evidence, and the decision was made on what the footage showed, not on what the software reported.
Can a good cheater fool a replay review?
Not perfectly. A skilled cheater can play in a way that looks legitimate on replay, and a legitimate player can look suspicious in a short clip. Replay review is a judgment call, which is why teams hand-check the bans instead of automating them.
Is replay review slower than automated bans?
It is usually slower, because it is manual. A replay review team that hand-checks 50 accounts at a time cannot match the speed of an automated ban wave, but the bans it issues are harder to dispute and less likely to hit innocent players.