CypherX Interactive Spheres Hosting LLC

Platform Security for Roblox experiences

AXIOM Anticheat.

A server-side protection layer for Roblox. AXIOM assumes the client is lying, recalculates the state that carries value, and scores whatever's left against how your players normally behave. It runs on our own titles, which is where every version gets broken in first.

Enquire about licensing How it works

Design principles

Built on three assumptions.

AXIOM exists because our own games needed it, so every decision in it comes from something that actually went wrong on a live server rather than from a threat model drawn on a whiteboard.

ASSUMPTION 01

The client is hostile

Anything running on a player's machine can be read, patched or replayed back at you. AXIOM never trusts a client-reported result. It recomputes the ones that matter and ignores the rest.

ASSUMPTION 02

Signatures go stale

A list of known exploits is always a list of yesterday's exploits. Baselines catch the shape of cheating even when the specific tool shipped this morning, which is why the two approaches are worth running together.

ASSUMPTION 03

False positives cost players

Ban someone who did nothing and you've lost them, plus everyone they tell. Responses are graduated, and every action stores the evidence behind it so an appeal can be answered with facts instead of a shrug.

How it works

What happens to a guarded action.

Four stages, all of them inside the frame the server was going to spend anyway. Nothing commits until the last one has an answer.

Intercept

Guarded remotes and state transitions are wrapped. Nothing reaches game logic unchecked.

Validate

Hard rules first: physics bounds, rate limits, ownership, payload shape and signing.

Score

What passes is compared to the player's own baseline and the server population's.

Respond

Clear, warn, throttle, rollback, isolate or ban, chosen per detection class, with the evidence attached.

axiom · configuration
-- ServerScriptService/AxiomBootstrap.server.luau
local Axiom = require(ServerStorage.Axiom)

Axiom:Init({
  mode      = "enforce",  -- observe | enforce
  telemetry = true,
  appeals   = true,
})

-- physics
Axiom:Watch("Movement", {
  maxStudsPerSecond = 42,
  maxVerticalDelta  = 18,
  toleranceFrames   = 3,
  onViolation       = Axiom.Action.Rollback,
})

-- economy
Axiom:Watch("Economy", {
  validate = function(player, delta)
    return delta <= Ledger:Earned(player)
  end,
  -- contain first, confirm, then ban
  onViolation = Axiom.Action.Isolate,
  onConfirmed = Axiom.Action.Ban,
})

-- remotes
Axiom:Guard(ReplicatedStorage.Remotes, {
  rateLimit = { calls = 12, perSeconds = 1 },
  schema    = true,
})

Drop it in, then tune it

AXIOM ships as a server module. Run it in observe mode for a fortnight and it touches nobody: it just builds baselines and writes down what it would have done. Read that, argue with it, adjust the thresholds, and switch to enforce when the list of would-be actions stops containing names you recognise.

  • No client dependency. Nothing to install on the player's side, nothing to bypass.
  • Budgeted. Detection work is bounded per frame so it never becomes the lag source.
  • Composable. Watchers are per-system; adopt movement first, economy later.
  • Moderator tooling. A review queue with replayable evidence, not just a ban list.

Containment

We don't always ban on first detection.

A ban is a loud, permanent answer to a question you might still be getting wrong. When AXIOM flags suspicious activity, the player is quietly moved into an isolated instance instead of a public server, and everything they do there stops at the door.

What the player sees

Nothing. The isolated instance looks and plays like a normal server, so there's no obvious moment that tips them off and no reason to switch tactics or start a new account.

What actually happens

  • Nothing is saved. No data, no progress, no rewards, no economy changes. The instance writes to nothing.
  • Everything resets on rejoin. The moment they leave and enter a public server, none of it carried over.
  • The real game is untouched. Other players never share a server with a live exploit, and the economy never sees it.
  • We get evidence. Behaviour keeps generating signal, which is what turns a suspicion into a confirmed case.

Bans are still used, for confirmed and serious violations. Containment is the safer first step that earns us the confidence to take one.

Public server Isolated instance
Look and feel Normal Identical
Player data Saved Never written
Progress Persists Discarded
Rewards and drops Granted Void
Economy effects Applied Contained
On rejoin Continues Resets
Detection A watcher flags behaviour it can't clear.
Isolation Quietly routed to a non-persisting instance.
Confirmed Evidence holds up, enforcement follows.
Cleared False alarm. Returned, nothing lost.

A cleared player loses nothing, because nothing they did in isolation was ever going to count.

Coverage

What AXIOM watches.

Detection classes are modular. Enable what your title needs and leave the rest dormant.

Movement & physics

Speed, flight, noclip, teleport and gravity manipulation, checked against the server's own simulation bounds.

Economy integrity

Currency and item grants reconciled against a server-side ledger. Duplication and injection fail closed.

Combat validation

Reach, fire rate, line of sight and damage magnitude re-derived on the server before a hit lands.

Remote abuse

Rate limiting, schema validation and argument signing on every guarded RemoteEvent and RemoteFunction.

Behavioural anomalies

Per-player baselines across session length, input cadence and progression rate. Outliers surface for review.

Account & alt patterns

Repeat-offender correlation and ban-evasion signals, weighted so shared households aren't punished.

Live enforcement log

Movement · 128 studs/s, 3.0× baseline ceilingBlocked
Remote · 240 calls/s on RequestRewardBlocked
Remote · unsigned payload on PurchaseItemBlocked
Economy · credit spike, 3σ from player baselineFlagged
Session · repeat flags — routed to non-persisting instanceIsolated
Combat · reach 21 studs vs 14 permittedBlocked
Combat · hit registered within toleranceCleared

Illustrative sample. Live dashboards are available to licensed studios.

Limits

What AXIOM won't do for you.

Every anticheat page on the internet lists what the product catches. Here's the other half, because finding this out three weeks into an integration is worse than reading it now.

It can't fix a client-authoritative game

If your server takes the client's word for damage, currency or position, AXIOM has nothing to compare against. The honest first step for some titles isn't buying an anticheat, it's moving those decisions server-side. We'll say so if that's you.

It can't see what it never receives

Visual cheats that only read data your server already replicated, wall hacks and similar, leave no trace on the wire. The fix is replicating less, not detecting more. We'll help you work out what to stop sending.

It isn't chat or content moderation

AXIOM watches game state. Harassment, scams and inappropriate content are a different problem with different tooling, and Roblox's own systems handle a large part of it. We don't pretend to cover it.

It doesn't guarantee zero exploits

Nobody can. New tools appear, and something will get through eventually. What AXIOM gives you is a shorter window, contained damage while you work, and enough evidence to understand what happened afterwards.

One more thing worth saying out loud. Anticheat is a running cost, not a purchase. The studios that get the most out of AXIOM are the ones who read the flags every week and tune the thresholds. If nobody on your team has time for that, tell us and we'll scope the support side properly rather than letting it quietly rot.

Getting started

A month, roughly.

The module itself drops in within a day. The rest of the time goes on baselines and arguing about thresholds, which is the part that decides whether the thing is useful or just noisy.

Week 1Integration. Module in, movement and remote watchers wired up, observe mode on. Nobody is enforced against.
Week 2Baselines. AXIOM learns your players. You get a daily list of what it would have done, and to whom.
Week 3Tuning. We go through the would-be actions together and move the thresholds until the false positives stop.
Week 4Enforce. Containment first, bans reserved for confirmed cases. Economy watchers usually go last.
AfterA monthly review while you want one, and a channel where you can shout at us when something looks wrong.

How licensing works

There's no price list, and that isn't a sales tactic. A tycoon with two hundred concurrent players and a competitive shooter with twenty thousand are different amounts of work for us, so we scope each one.

What we ask for up front:

  • Your experience link and typical concurrent players.
  • Which exploits are actually costing you players right now.
  • Whether your economy and combat already run server-side.
  • Who on your side will read the flags each week.

We turn down more enquiries than we accept, usually because we can't support the title properly at the time. A no arrives quickly and with a reason.

Already running something else? AXIOM coexists with most Roblox anticheat modules during a migration. Running both in enforce mode is a bad idea, though. Pick one to hold the trigger.

FAQ

Questions we get asked.

Is AXIOM available to studios outside CypherX?
Yes, selectively. It was built for our own titles and still ships there first, so a licence comes with the same version we're running. Send your experience link, concurrent player range and the exploits hurting you most, and we'll tell you whether it helps. Sometimes the answer is that your problem is architectural and we'd be taking your money.
Does it need a client-side component?
No. AXIOM is entirely server-side. There is nothing on the player's machine to detect, patch or bypass, and no impact on load times. Optional client hints can improve accuracy for some detections, but nothing depends on them being honest.
What does it cost in server performance?
Detection work is budgeted per frame, and the expensive checks are sampled rather than exhaustive. If the budget is exceeded, AXIOM degrades to hard-rule validation only. It will never become the reason your server drops frames.
How are false positives handled?
Enforcement is graduated per detection class: most anomalies warn, throttle or isolate long before they ever ban. Containment is deliberately reversible, so a wrongly flagged player loses nothing, because nothing done in an isolated instance was ever going to be saved. Every action is written to an audit log with the triggering evidence, and the optional appeals flow lets moderators review a replayable case rather than a bare verdict.
What happens to a player who gets flagged?
Usually not a ban. They're moved into an isolated instance that looks and plays like a normal server but persists nothing: no data, no progress, no rewards, no economy changes. That keeps the real game clean while we confirm or rule out the detection. Bans are reserved for confirmed, serious violations. Full detail here.
How long does onboarding take?
The module drops in within a day. Budget a month before you're enforcing properly: two weeks of observe mode to build baselines, then a week of arguing about thresholds with us. Week by week here.
Where does our telemetry go?
Detection data stays with your game. We see aggregate health metrics for licensed deployments so we can tell when a release of ours has made something worse, and nothing else. We don't sell it, pool it across studios, or use your player data to train anything.
What if we want to stop using it?
Remove the module and your game keeps running. AXIOM sits alongside your systems rather than inside them, so there's nothing to untangle. Your enforcement history gets exported to you on the way out, since your moderators will still need it.

Talk to us about AXIOM.

Tell us about your experience and what you're seeing. We'll come back with a straight answer.

Start a conversation See it in production