Kernel anti-cheat in 2026: what actually changed

If you followed 2026 through forum threads, it looked like noise, but what actually shipped shows one clear line. The requirement moved from the software layer to the platform layer. For years, anti-cheat vendors tried to verify a machine from inside it. Now the machine has to prove something about itself before the game will start at all. That is a new problem for everyone involved, including anyone running a two-machine build, so it is worth understanding precisely rather than through rumour.

What you can verify yourself

Start with claims you can check yourself on a publisher's own support page, because that is the only kind worth basing a decision on. Activision's support site states that both TPM 2.0 and Secure Boot are required to play Call of Duty: Black Ops 7 and Call of Duty: Warzone. The same requirement applies to the Call of Duty: Modern Warfare 4 beta. The supported operating systems are Windows 10 version 22H2 or later, or any version of Windows 11. Titles that do not hard-require it often gate specific modes instead, usually ranked and tournament play. If a casual queue still works, that alone does not show that the policy is absent from the game.

As of September 2026. Every row can be checked against a first-party source, and nothing that cannot be checked has been included.

What does attestation actually measure?

Secure Boot means the firmware will only hand control to signed boot components, and a TPM means the platform can measure what it loaded. Together they narrow down what a game's client can be running on top of. That is genuinely useful against one whole class of software cheat, the kind that relies on an unsigned driver or a modified boot path. This is why the requirement spread.

It is just as important to be precise about what attestation does not measure. It describes the machine running the game and says nothing about a second physical machine on the other end of a cable. That gap is exactly the architectural point of a two-machine build. Some people will tell you that attestation makes hardware approaches obsolete, and others will tell you it is therefore irrelevant to hardware approaches. Neither conclusion holds up when you think it through.

What does this mean for a two-machine build?

• The game machine now has to meet the platform requirement like any other player's machine, which means Secure Boot on, a TPM enabled and a supported Windows build. Builds that ran with virtualisation features switched off in odd combinations, to make something else behave, are the ones that break first.
• Where you used to meet the requirements by turning things off, you now meet them by turning things on. That is a real change in how these setups are built, and it makes some fragile BIOS tricks from the last few years obsolete.
• The requirement is enforced at launch, so a misconfigured machine fails visibly and immediately, which is better than the alternative and makes the check cheap.
• The second machine sits outside the attestation boundary, so it has no requirement to meet. That is a statement about scope, not about safety.

How to follow anti-cheat news without being misled

1. 1Prefer first-party sources, such as a publisher's support page, a platform vendor's documentation or a devblog, rather than aggregator posts or screenshots of them.
2. 2Record the date of every claim you keep, because in this niche a fact from nine months ago is often no longer true.
3. 3Keep what has been announced separate from what has shipped and what is enforced, because all three get reported as if they were the same thing.
4. 4Treat provisional timelines as provisional, because phase-two dates slip constantly and still get quoted as commitments.
5. 5When something is community inference, keep that label attached to it, because a guess starts to be repeated as fact once the label is lost.

Overall, the change in 2026 was undramatic: the minimum requirement went up. Getting into a game now needs a machine that can attest to its own boot state, and that rule will keep spreading. It works well enough against the cheapest attacks to be worth the support cost. Everything above that minimum is unchanged, including the fact that no architecture removes detection risk.