Field Guide · Anti-cheat

Activision RICOCHET

RICOCHET is Activision's in-house kernel-mode anti-cheat, deployed across the Call of Duty franchise since 2021. The kernel driver loads while a protected Call of Duty title is running.

kernel · with gameLoads a kernel-level driver while the game runs, then unloads it when you quit.

How it loads

While a protected game runs

Firmware it asks for

None catalogued

Games catalogued

Catalogued as of

June 2026

What it can and cannot see

RICOCHET's kernel driver loads when a Call of Duty title launches and unloads when it closes, so it watches the host only while you are playing. Activision pairs it with server-side machine learning and in-game mitigations it documents publicly. While it runs it can examine the machine it is on; it does not see a second computer or a capture device outside that machine.

The same boundary applies to every anti-cheat here. Anti-cheat that runs on your PC can examine what happens on that PC, to the depth its design allows. It cannot see a second computer, a capture device, or hardware placed between an input device and the port it plugs into. That is why the presence of an anti-cheat is not, on its own, proof of anything about a player, in either direction. Vera describes what runs; it does not decide what it means.

Games that use it

Call of Duty: DMZ

Activision·kernel · with game

Call of Duty: DMZ (Modern Warfare 4)

Activision·kernel · with game

Call of Duty: Modern Warfare 4

Activision·kernel · with game

Call of Duty: Modern Warfare II

Activision·kernel · with game

Call of Duty: Modern Warfare III / Warzone

Activision·kernel · with game

Source

Catalogued by Vera from the anti-cheat maker's own documentation and named public reporting (Ars Technica, PC Gamer, Eurogamer, BleepingComputer, and others). Anti-cheats change; these notes reflect the public record as of June 2026. What is here is public evidence, never an accusation about a person.