FiveM anticheat comparison, without the scoreboard

Why comparison pages mislead

Search for a FiveM anticheat and you will find several comparison pages, each published by a vendor, each showing that vendor winning. The rows are chosen after the winner is known. That is not dishonest exactly. It is a sales page wearing a lab coat.

This page is published by a vendor too. The difference is that our product is in closed alpha and would lose a feature-count comparison against every established name on this page, which is stated plainly further down. What follows is the reasoning we would want if we were the ones buying.

The four approaches

Nearly every product in this market is some mixture of four techniques. They are not ranked, they fail in different places, and the mixture is what matters.

The market is thick with the first two and thin on the third. That is a commercial fact rather than a technical one: a signature list is quick to expand and easy to advertise, while server-side validation means auditing every event a server already exposes, which is slow and invisible on a feature list.

A cheat that has been bypassed once stays bypassed until someone maintains the list. An exploit that the server refuses to execute stays refused.

Claims to treat carefully

None of the following is a claim that a particular vendor is dishonest. They are phrases common across the market that mean less than they appear to, each for a specific reason.

“99.9% detection rate”

Unverifiable by anyone, including the vendor. Measuring a detection rate requires knowing how many cheaters were not caught. Nobody has that number, because it is the definition of what was missed. Treat any published percentage as a marketing figure, not a measurement.

“HWID bans”

Not what the words suggest. FiveM resources cannot read hardware serials: there is no native code interface, a companion app that could read them breaks the platform terms, and spoofers rewrite those values below the level anything can read them. What vendors call a HWID ban is, in practice, a ban tied to platform-issued player tokens. Useful. Just not hardware.

“DMA cheat detection”

Behavioural analysis under another name. A DMA cheat reads memory from a second machine over a PCIe card. No process, no driver and no code of the attacker runs on the gaming PC. A sandboxed resource cannot observe it. What can be observed is a player behaving as though they know things they should not. That is behavioural analysis, sold with a hardware label.

“Kernel-level protection”

Not available on this platform. FiveM does not let a resource ship a driver, and requiring players to install separate software to join a server is against the platform terms besides. Anything genuinely kernel-level would have to live outside the ecosystem.

“Global ban database”

Convenient, and worth reading the policy on. A shared ban list means someone else's moderation decision applies to your server, with their evidence standard and their appeal process. Check who can add an entry, what evidence is attached, and how a wrongly banned player gets removed.

“OCR screen scanning”

High cost, decaying returns. Reading text off a player's screen to spot menu names is defeated by stream-proof rendering, which current menus ship by default, and it produces false positives on innocent overlays. It also asks a lot from players in privacy terms for what it delivers.

“VPN and country blocking”

Catches the wrong people. It reliably blocks travellers, shared connections, mobile networks and diaspora communities. A cheater buys a residential proxy for a few euros. The ratio is not in your favour.

Five questions to ask

Ask these of any vendor, including us. The answers separate products far better than a detection count does.

1. What is the false-positive rate, and how was it measured?

This is the question that decides whether you can leave an anticheat switched on. A vendor who has measured it can tell you the number and the method. A vendor who has not will answer with a feature list.

2. What happens on an ambiguous detection?

Ask whether a statistical signal can end an account without a human looking at it. If the answer is yes, you will eventually be apologising to a paying member of your community.

3. What evidence comes with a ban?

You will be asked to justify bans. If the product cannot hand you a reproducible record of what happened, every appeal becomes your word against theirs.

4. What does it cost at your actual player count?

Ask for the measurement, at a player count close to yours, taken with the server profiler rather than estimated. An anticheat that costs tick rate gets switched off, and then you have none.

5. What leaves your server, and what is done with it?

Reports, telemetry and scan output can carry secrets from your own configuration. Ask what is transmitted, whether it is masked, and who can read it.

The vendors people shortlist

Compiled from each vendor's own public pages and checked on 2026-07-25. Descriptions are what they advertise, not verified behaviour, and prices change, so confirm before you buy.

One dynamic worth knowing about before committing to a long licence: anticheat code in this ecosystem gets leaked and decompiled, and once detection logic is readable, targeted bypasses follow. Effectiveness decays unless the product is actively maintained, which is an argument for treating any anticheat as a subscription rather than a purchase, and an argument for keeping detection logic off the machines you ship to.

Where SwisserAC stands

Honestly: behind, on coverage. SwisserAC is in closed alpha, everything runs in shadow mode, and several layers of the design are specified but not yet built. If you need protection on a busy server tonight, buy something that ships today.

What is different is the shape rather than the size:

• Server-side facts and statistical signals are kept apart, and only the first is ever allowed to act on its own.
• Every rule has to earn its way from logging, through warning, to enforcement, on a measured false-positive rate.
• Detection logic lives in our backend, not in the files installed on your server, so it is not sitting in a file waiting to be read by whoever wants to bypass it.
• Nothing runs on your players' machines in the current build, and no kernel driver or companion app is planned for any later one.

Whether that is worth waiting for is a judgement about the next year, not about today. The architecture is laid out in full on the home page, and the alpha is open to a small number of servers.