Three billion players, one massive attack surface. A fellow gamer breaks down the risks hiding in your favourite games — and how to actually protect yourself.

Benjamin McMichael – Intern, Cyber Security Institute*

 

Whether you’re a dedicated gamer or someone who just likes to unwind with a game after a long day, you probably don’t think of your gaming activities as a target for cybercrime. The truth, however, is very different.

As a final year game design student and intern at the Cyber Security Institute, I have a keen interest in both gaming and cyber security. My experience in both fields has shown me that cyber security for gaming is a neglected topic, but a critically important one. Online gaming has a global estimated population of over 3 billion players. In cyber security terms, this represents a massive attack surface.

“While most devices used for work purposes are covered by some level of threat protection, many devices used for gaming are not — and cybercriminals know it.”

This post focuses on PC gaming specifically. From a cyber risk perspective, PC gaming is significantly more insecure than console gaming. The open nature of the PC platform exposes users to a far wider array of attack vectors compared to the more restricted, sandboxed environment of consoles.

A prime example is the so-called “Shortcut Culture” in PC gaming — cheats, mods, and cracks — fuelled by the willingness to compromise security for competitive advantage or free content. Many gamers face threats ranging from malware to identity theft, account loss, and even doxxing, without even realising it.

 

Use Legitimate Game Marketplace Platforms

One of the most fundamental ways gamers protect themselves is by using credible gaming platforms — Legitimate Digital Distribution Platforms (LDDPs). Examples include Steam, Epic Games, Battle.net, the Ubisoft Launcher, and the Riot Client.

These platforms offer a controlled ecosystem in which to buy games while remaining safer from bad actors. While scammers can still appear on LDDPs, the risk is significantly reduced. That said, there is no such thing as zero cyber security risk. On platforms like Steam, where marketplace trading takes place, gamers can be scammed while trading skins — some of which hold significant real-world monetary value.

 

Enable Multi-Factor Authentication

One very effective way to protect your gaming assets and accounts is by deploying multi-factor authentication (MFA). Most legitimate platforms have MFA set up, requiring a confirmation on your phone at each sign-in.

In my own experience, Steam’s MFA gives the exact location of each login attempt and offers two verification methods: scanning a QR code or entering a time-limited code from the mobile app. While it can feel like friction, the protection it provides is substantial.

Why It Matters

If a malicious actor obtains your password through a scam or data breach, MFA means they still cannot access your account without your physical device. It’s free, easy to set up, and one of the most effective protections available.

 

Download Games from Legitimate Sources Only

Pirating games is not uncommon, but the risk involved is substantial. A pirated game typically requires running an installer file — an .exe file — whose contents are completely unknown and could contain trojans or other malware. This is one of the most common ways gamers put themselves at risk.

“If you are not paying for the product — you are the product.”

 

Use a Reputable Anti-Virus Solution

An anti-virus solution reduces the risk of malware from a downloaded game being able to deploy on your PC. Windows Defender is many gamers’ default, but an enhanced option offering identity theft monitoring, credential protection, and advanced network firewalls is strongly recommended.

Consider upgrading to solutions like Bitdefender Total Security (with Game Profile), Malwarebytes Premium, or Kaspersky Gaming Edition for more comprehensive protection.

 

Understand Kernel-Level Anti-Cheat Software

Kernel-level anti-cheats are a big sticking point in the gaming community. Once installed, they operate at a higher privilege level than your own user account — meaning they can perform tasks you cannot, without asking for permission each time.

Examples include Riot Games’ Vanguard (which runs as a system-level service from the moment the OS boots) and Easy Anti-Cheat (which only activates when a compatible game is launched). In any other context outside gaming, a kernel-level anti-cheat would be classified as a remote access tool given what it accesses and controls.

Two Practical Options

To reduce privacy risks: either avoid games that require kernel-level anti-cheat entirely, or use a Virtual Machine or dual-boot setup — keeping your personal and work files completely separated from your gaming environment.

 

Stay Alert on Community Platforms

Community platforms like Discord have become specific targets for cyber-attacks. A common example is fake Discord Nitro giveaway links, which trick users into entering their login credentials. Once an account is compromised, it’s often used to spread malicious links to servers and contacts — quickly leading to further compromises across multiple users.

The rule here is simple: do not click on anything suspicious. If you receive a link offering something free, especially involving crypto or exclusive offers, treat it as click-bait — even if it appears to come from a friend.

 

Best Practices — from a Gamer, for Gamers

• Be alert to sketchy links and odd behaviour on Discord, Steam, and any platform you use.
• Use a reputable gaming anti-virus solution to boost your device’s security.
• Don’t pirate games — buy them or wait until you can. The risk simply isn’t worth it.
• Stick to legitimate gaming platforms for all purchases.
• Never click links you can’t verify — urgency or ‘too good to be true’ are red flags.
• Enable MFA on all your accounts. It’s free, quick to set up, and highly effective.

 

Happy, safe gaming!

 

*Benjamin McMichael is a final-year Game Design student and student intern at the Cyber Security Institute. With a passion for both gaming and cyber security, Benjamin explores the intersection between digital entertainment and cyber risk, helping gamers understand the threats that exist beyond the screen.