Activision RICOCHET
RICOCHET is Activision's in-house kernel-mode anti-cheat, deployed across the Call of Duty franchise since 2021. The kernel driver loads while a protected Call of Duty title is running. Since the Black Ops 7 beta in October 2025, Activision has also required TPM 2.0 and Secure Boot for Black Ops 7, for Warzone since December 4, 2025, and for Modern Warfare 4, checking the settings by attestation against Microsoft Azure servers; earlier titles are not named in that requirement, so this guide records the ask on each title rather than on RICOCHET as a whole.
RICOCHET's kernel driver loads when a Call of Duty title launches and unloads when it closes, so it watches the host only while you are playing. Activision pairs it with server-side machine learning and in-game mitigations it documents publicly, and on its newer titles with remote attestation: a check, made with Microsoft's servers, that the PC's TPM and Secure Boot settings are what they claim to be. While it runs it can examine the machine it is on; it does not see a second computer or a capture device outside that machine.
Catalogued by Vera from the anti-cheat maker's own documentation and named public reporting (Ars Technica, PC Gamer, Eurogamer, BleepingComputer, and others). Anti-cheats change; these notes reflect the public record as of October 2026. What is here is public evidence, never an accusation about a person.