Accuracy

The general benchmark for what constitutes a good anti-cheat is how accurate it is. How many cheaters does it catch? How many innocent players does it falsely detect? Perfect accuracy isn't achievable; therefore, the software must always make a compromise. Depending on factors such as the game and the company developing it, the ideal solution can vary. Minimizing the chances of false positives is the most commonly accepted approach since it increases player trust in the system.

Some games have used systems where any irregularities are flagged and manually verified before applying a ban. This approach, whilst generally accurate, comes with a massive labour cost. Other games may impose a ban for every irregularity and provide appeal systems to correct false positives. However, this approach can cause players to lose trust in the anti-cheat and lead to clashes between the community and developers. In games with severe cheating problems, it is sometimes worth sacrificing a few false positives to catch more cheaters.

When dealing with false positives on an individual basis, there should be a system to revert them. I have a false-positive VAC ban on my steam account from early 2015 that cannot be appealed due to the lack of such a system.

Techniques

There are numerous techniques for anti-cheat, some of which can be employed simultaneously for improved detections.

Punishments

The punishments for cheating are an oft-debated topic, with opinions varying from too harsh to too lenient. On the harsh side, some services permanently ban a computer for a single cheating infraction. On the forgiving side, services may warn the player or revert actions related to cheating. None of these are wrong; the punishment should fit in with the game's specific circumstances and the severity of the incident.

Another aspect that you must consider is how to deal with false positives. For more severe punishments, this is especially important. I touched upon this briefly in the section on accuracy. However, there is much more to it. In cases of false positives, it's better to create a community that doesn't believe in them. Otherwise, illegitimate claims of false positives can tarnish the reputation of a company. If someone claims to have been banned falsely and does not get unbanned, anyone who believes them may lose faith in the company, or stop purchasing their games in the future for fear of being banned.

Concerning severity, there is pre-existing psychological research to use. It's evident that when there's a low severity punishment, such as a 3-warning system, people who are on the fence about cheating are more likely to cheat. In scenarios where penalties are very severe, the undecided are less likely to cheat. Perhaps unsurprisingly, it has been found that any ban longer than three years is unlikely to impact the likelihood of cheating. If someone will cheat and receive a 3-year ban, they will cheat and receive a lifetime ban. This finding is likely due to the prevalence of accounts created purely for cheating.

One contested aspect of cheating punishments is a social punishment. The most well-known implementation of this is Valve's VAC. When banned, players have a red message on their profile page, informing other players that this person has cheated in the past. This warning leads to social stigma throughout gaming communities, extending beyond the game and account the ban occurred in. I've written an article about this in more depth from a personal perspective. Studies have shown that players with bans are likely to have a smaller friends list after the ban, and more banned friends.

Alternatives

One potential alternative to anti-cheat in some situations is to create the gameplay to limit the impact of cheats. One example of this is Facepunch's game Rust. There is a gameplay mechanic in Rust that allows players to protect their items and doors with a combination lock. Bruteforcing cheats quickly emerged which attempted codes until they found the correct one. These were patched by having the combination lock 'zap' the player upon an incorrect code, increasing in severity on each wrong attempt. Not only does this add to the gameplay, it also prevents players using this form of cheat. Of course, you can't solve every form of cheating with this method. However, it's something to consider.

Is it worth it?

From a business perspective, creating a state-of-the-art anti-cheat system is rarely worth it. Minimizing cheating is an important goal to have, but not if it ends up consuming a large portion of available resources. If preventing cheats stops you from adding features or fixing other issues in a game, it may no longer be worth it. If a game is having serious cheating problems, it may be worth rethinking the type of anti-cheat in use, rather than spending large amounts of time implementing small improvements to the current system. Adding features and increasing the game's value for customers impacts a company's bottom line while preventing cheating may not.

In only particular situations does cheating have a statistically significant impact on the success of a game. If there is only a minor cheating problem, it's probably not worth spending a lot of time and money on the solution.

Conclusion

Anti-cheat is not a 'one size fits all' system. It would be best to choose appropriately for each game, and the specific resources the development team has available. Appropriate punishments depend on support measures and the rate of false positives. Anti-cheat requires more thought than most people usually think, and is a vital part of the game. Inadequate or improperly managed solutions are more of a burden on the players than the cheaters that it is there to prevent. A well-established anti-cheat system can make the game more enjoyable by reinforcing the player's confidence in the game's fairness.