Activision expands RICOCHET anti-cheat across Black Ops 7 and Warzone

Activision rolled out a major upgrade to RICOCHET anti-cheat on January 9, 2026, changing how Black Ops 7 and Warzone detect and respond to cheating in real time. The new setup layers kernel-level monitoring, server-side machine-learning analysis, and hardware validation to both identify bad actors and shield legitimate players while investigations run.

At the core, RICOCHET still uses a kernel-level driver on PC to monitor processes while the game runs, but the platform now leans harder on hardware-level checks. TPM 2.0 and Secure Boot are mandatory on PC for full access, and Black Ops 7 adds a Remote Attestation layer that lets servers validate a client’s TPM and Secure Boot state via cloud validation. Server-side machine-learning models analyze aim and behavior patterns to flag anomalies, and reports from players feed those models to improve detection over time.

The system does more than collect evidence and queue bans. To reduce immediate damage to matches, RICOCHET deploys live mitigations. Suspected cheaters can be placed in limited-matchmaking or special lobbies, have their weapons removed through a disarm action, be invisible to targeted legitimate players with cloaking, or be blocked from dealing damage using damage shields. Those measures aim to keep rounds playable while enforcement catches up, lowering the payoff for repeat offenders without waiting for slow ban appeals.

For players the practical impact is straightforward. If you plan to play on PC, enable TPM 2.0 and Secure Boot in your BIOS ahead of launch, and keep Windows and GPU drivers fully updated so hardware checks and attestation can complete smoothly. Use in-game reporting when you see aimbot, ESP, or other clear cheating behaviors; those reports are a direct input to the detection models. Be aware that the kernel-level driver and attestation widen the scope of system-level checks, which raises privacy and security concerns for some users who prefer minimal background access.

This layered approach shifts the game away from a ban-only model toward live match protection and faster enforcement. Expect fewer lopsided matches when mitigation features are triggered, but also expect that some players may opt out or face access limitations if their systems cannot meet TPM and Secure Boot requirements.

Our two cents? Flip TPM 2.0 and Secure Boot on, patch Windows and drivers, and keep reporting trash players. You’ll help the system learn faster and spend more time grinding actual gameplay, not dodging aimbots.