[Dwedit]

The problem with building a secret profile on players based on undisclosed metrics is that could be flagging legitimate programming tools as "risk". What if a programmer who likes to hack and mod other games decides to play a Valve game? You don't know how their "risk" score is calculated.

For example, I've seen other programs refuse to run if you had Sysinternals Procmon running, or various standalone debuggers. Would you be deemed a "risky" user if you used tools like that?

[drnick1]

Having watched that video, their newer ML-based anti-cheat does not seem to rely on inspecting running processes. It is based on data surrounding when a gun is fired in the game (a certain number of ticks before and after), and the classifier is initially trained on human-reviewed "killcams." But the classifier probably takes into account other data too, for example new Steam accounts with only CS in it would probably be classified as "high risk." On the other hand someone who has had their account for a long time and has paid games in it is far less likely too cheat.