BattlEye vs Easy Anti-Cheat: Technical Comparison in 2026

BattlEye and Easy Anti-Cheat are the two kernel-mode drivers that gate most of the PC multiplayer market. If you play PUBG, Rainbow Six Siege, DayZ, Arma 3, Escape from Tarkov, or GTA Online, BEDaisy.sys runs at Ring 0 while you play. If you play Fortnite, Apex Legends, Rust, Elden Ring PvP, or (as of April 2026) Rocket League, the driver is EasyAntiCheat.sys. Both hook the same syscalls and coexist with PatchGuard and HVCI. They diverge on corporate structure, ban philosophy, and how aggressively they pester the kernel while a match is live.

Who owns what: BattlEye vs the Epic acquisition

BattlEye Innovations e.K. is a small independent German company founded in October 2004 by Bastian Suter, operating out of Reutlingen. It has stayed independent for over two decades. There is no parent conglomerate, no board of directors publicly pressuring the roadmap, no vertically integrated storefront funding the R&D. BattlEye gets paid per title integration and keeps shipping. Their own homepage still opens with the phrase "100% independent," which is unusual middleware copy.

Easy Anti-Cheat has the opposite story. Kamu, the Finnish company that built EAC, was acquired by Epic Games on October 8, 2018. Since then EAC has been folded into the Epic Online Services stack, made available royalty-free to any developer using EOS, and rebuilt substantially. The driver that ships in Fortnite in 2026 shares a name with the driver Kamu shipped in 2015 and almost nothing else. Epic has poured engineering budget into it because Fortnite is the flagship, and Fortnite bleeds revenue every day cheaters go undetected. Epic markets EAC as protecting more than 200 games and 20 billion gameplay sessions annually.

That ownership difference shows up everywhere. BattlEye ships when BattlEye is ready. EAC ships on Epic's calendar. Cadence in 2025 and 2026 was fast: EOS SDK 1.17.1.3 in August 2025 added Windows on ARM support (Fortnite was the launch title on Snapdragon devices), and further SDK releases through February 2026 carried EAC updates in each drop.

Titles under each driver in 2026

The current split of major PC titles looks like this:

Two common misreads to correct. Rust runs on EAC and has for years; Facepunch's 12-year retrospective in 2025 confirmed the partnership and previewed a new anti-cheat layer on top of EAC for 2026. Fortnite is EAC, not BattlEye. Fortnite briefly shipped BE integrations back in 2017 and still appears on BattlEye's public customer list, but Epic drives Fortnite protection through EAC.

Quick disk check for the shipped sidecar:

Get-ChildItem "${env:ProgramFiles(x86)}\Steam\steamapps\common\Rust" -Recurse -Include EasyAntiCheat.sys,BEDaisy.sys

Facepunch's 2025 ban numbers show what an EAC integration produces at scale: 338,000+ Rust bans, 296,000+ of them permanent, a 27% year-over-year increase, and median cheater removal down from ten hours of playtime at year-start to under seven by year-end.

Architecture side by side

Both drivers do the same job. Implementation choices differ enough to matter. Adrián Díaz's static-analysis writeup of BEDaisy.sys and the 2025 ACM MATE workshop paper "Battling The Eye" give a decent picture of the BE side; the EAC side is documented through Epic's anti-cheat integration docs.

Both are honest about being kernel-mode AC. Neither is a shim over Windows Defender. Both coexist with Microsoft's signed third-party driver Blocklist enforcement, and neither has appeared on the blocklist. The delta is mostly cultural: EAC audits itself more aggressively because Epic can afford the engineer-hours, and BE ships tighter, more targeted detections because every commit reaches every title at once.

Ban philosophy: bulk waves vs the quiet catch

This is where the two vendors diverge, and where a cheat customer feels the difference. Older KyTech posts and community lore still reference a "BEBans.txt" global feed, but by 2026 there is no first-party BattlEye public ban stream. Bans surface as per-publisher IDs. Bohemia calls out "Global Ban #ID" records on the Arma 3 support portal. Krafton posts monthly PUBG ban tallies. Ubisoft absorbs BE bans into its own moderation reporting. A BattlEye ban in Tarkov does not automatically carry to Rainbow Six Siege; each publisher runs its own list.

BattlEye still ban-waves publicly, just through the publishers. When BE catches a new cheat vector, thousands of accounts drop the same day and every cheat forum knows within hours which vector burned. The velocity is unchanged even if the delivery mechanism is now decentralized.

Easy Anti-Cheat still does the opposite. There is no public ban log for EAC. Bans attach to Epic Games, EA, or Steam accounts silently, batched into waves that hit weeks or sometimes months after the actual detection. That delay is deliberate. A silent detection window means the cheat developer keeps shipping, users keep buying, and the entire population of that cheat gets rolled up at once. VAC pioneered this approach; EAC has adopted the same philosophy while running detections closer to real time. The ban-wave anatomy post walks through how the delay windows work in practice.

The trade-off is transparency. A BE ban tells you when it happened and roughly why. An EAC ban tells you nothing except that you cannot log in. For anyone testing cheats, EAC bans are harder to correlate to a specific behavior, which is exactly the point.

False positive history and the overlay problem

BattlEye has a longer history of false positives than EAC, and the receipts are searchable. Every OBS Studio release cycle used to bring a PUBG ban wave that caught streamers, and the resolution was usually a whitelist patch shipped a week later. BE's approach is aggressive: if a module in the game process is not on the allow list and looks suspicious, it flags. That posture catches cheats early and burns legitimate software occasionally.

EAC has moved in the opposite direction. Since the Epic acquisition, EAC has invested heavily in reducing false positives because every one on Fortnite becomes a Twitter incident. The current EAC posture is closer to "verify twice, ban once." Detection latency is higher and wave cadence is slower, but the false-positive rate on shipped bans is notably lower. Neither vendor publishes numbers, so this is directional. Community complaint volume is measurable, and BE still generates more of it per active player.

Modding tolerance

If you run an Arma 3 or DayZ server with custom mods, BattlEye has to tolerate you or the modding scene dies. BE ships a per-server whitelist where operators register mods and BE accepts the loaded modules. This is why the Arma and DayZ modding communities have survived kernel-mode AC at all.

EAC by default is much more restrictive. Rust plugins run only in the trusted server context, not client-side. Sea of Thieves and Fortnite are not moddable, and EAC does not accommodate arbitrary loaded DLLs. When EAC is deployed on a moddable title, integrators must build custom mod-signing infrastructure on top of it, and few do. The practical result: if you are researching a title with a mod scene, BE's permissive stance leaks more information through legitimate mod APIs. On a locked-down title, EAC gives you nothing.

What the driver actually does in memory

Both drivers register kernel callbacks the same way. Here is the shape of what BattlEye and EAC both do at load time, using documented Windows kernel APIs:

// Both BE and EAC do this at DriverEntry
NTSTATUS RegisterCallbacks(PDRIVER_OBJECT DriverObject)
{
    // Watch every process creation and termination
    NTSTATUS status = PsSetCreateProcessNotifyRoutineEx(
        ProcessNotifyCallback,
        FALSE);
    if (!NT_SUCCESS(status)) return status;

    // Register a handle-open filter to strip PROCESS_VM_READ
    // from any handle opened against the protected game process
    OB_OPERATION_REGISTRATION opReg = { 0 };
    opReg.ObjectType = PsProcessType;
    opReg.Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
    opReg.PreOperation = HandlePreCallback;

    OB_CALLBACK_REGISTRATION cbReg = { 0 };
    cbReg.Version = OB_FLT_REGISTRATION_VERSION;
    cbReg.OperationRegistrationCount = 1;
    cbReg.OperationRegistration = &opReg;
    RtlInitUnicodeString(&cbReg.Altitude, L"320000");

    return ObRegisterCallbacks(&cbReg, &g_CallbackHandle);
}

The handle callback is the piece cheat developers spend most of their time trying to survive. When your cheat calls OpenProcess(PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, gamePid), the pre-operation callback fires inside the AC driver and strips the read and write bits from the requested ACCESS_MASK before the handle is created. Your OpenProcess returns success. Your subsequent ReadProcessMemory returns ERROR_ACCESS_DENIED.

BE and EAC both do this. The difference is what altitude they register at, how strict the filtering is against NtDuplicateObject attempts to launder handles, and whether they also filter thread handles for THREAD_GET_CONTEXT (needed for register scraping). EAC currently filters more aggressively across handle types. BE filters the essentials and relies on periodic memory scans to catch anything that slipped through. The tradeoffs between usermode-only and kernel enforcement are covered in the architecture overview.

Integrity self-checks

Both drivers rehash their own .text sections on a schedule. EAC does it more often and cross-checks the driver's in-memory image against a known-good hash the launcher stored at load time. If the check fails, the driver signals the game to disconnect and eventually the account eats a ban.

A simplified sketch of what that self-check looks like from usermode:

# EAC-style usermode integrity heartbeat pseudocode
$driverHandle = [System.IO.File]::Open(
    "\\.\EasyAntiCheat",
    "Open",
    "Read",
    "ReadWrite")

$request = New-Object byte[] 16
# Opcode 0x01 = "prove you're still you"
$request[0] = 0x01

$response = New-Object byte[] 64
$driverHandle.Read($response, 0, $response.Length)

# Response contains a SHA-256 of the driver's .text plus a nonce
# The launcher verifies against a challenge it just sent
if (-not (Verify-Nonce $response)) {
    Report-Tamper
    Exit
}

The real IOCTLs and structures are obfuscated and change every build, but the shape is right. A cheat that patches the driver's code in memory dies at the next heartbeat. A cheat that only hooks the launcher's verification path still has to survive the driver's own independent verification, which is why serious cheats do not attempt to patch either component and instead work around them entirely through hardware DMA readers or hypervisor-based hiding.

The 2026 verdict for buyers

Ranking them as "best" is a category error. They serve different publishers who want different things.

Publishers who want aggressive detection velocity and can tolerate occasional overlay drama pick BattlEye. Rainbow Six Siege has stayed on BE through every major patch since 2016 because Ubisoft values the ban-wave cadence. Publishers who want tight integration with a live-service telemetry pipeline, cross-platform reach (including Linux via Proton), Windows on ARM support, and can absorb Epic's licensing terms (free with EOS) pick EAC. Fortnite proved the model at scale.

For a cheat customer, neither is "safer" to use against. Both are kernel drivers, both hook the same syscalls, both eventually catch memory readers that operate from usermode. Any provider claiming they beat EAC but not BE, or vice versa, is being cute with marketing. The bypass problem is architecturally identical. Our companion post on Easy Anti-Cheat's architecture walks through the specific callback surface and heartbeat behavior, and the 2026 cheat buying guide is more useful than any AC-vs-AC ranking if you are picking a product.

How KyTech handles this

KyTech was founded in 2025 by two engineers who spent the prior years reverse-engineering the exact drivers this post is about. The product line covers Apex Legends (EAC), Counter-Strike 2 (VAC), Overwatch 2 (Defense Matrix plus kernel components), Call of Duty Black Ops 7 (Ricochet), Forza Horizon 6, and Roblox (Hyperion). Every KyTech product ships as a kernel driver because usermode cheats against modern AC do not survive first contact.

When KyTech develops against EAC on Apex, the driver reads game memory from a context that never opens a handle to the game process, because EAC's ObRegisterCallbacks filter would strip the access rights first. The high-level shape is documented Windows kernel work: attach to the target EPROCESS, copy into a buffer the driver owns. Against a BE title, the read path is functionally identical because BE's handle stripping is the same wall. What changes is the heartbeat cadence, the memory regions the driver sweeps, and the ban-wave timing to plan around. BE burns a bad revision within hours through public per-publisher waves. EAC lets it run for weeks and catches a season's worth of users at once, which changes how KyTech stages releases.

KyTech's HWID spoofer is currently in Apex-only beta because EAC's hardware fingerprinting is well documented and worth solving first. Ports to BE-protected titles are on the roadmap. The EAC integration this post describes is exactly what KyTech Apex ships against in production. If you want the current lineup and pricing, the KyTech store has everything live. No uptime numbers, user counts, or detection rates are published because the market that quotes those numbers is quoting fiction.