The short version: A single player launch tests your servers. An online launch tests your trust model. The exploits that hurt live games most are logic flaws, not exotic hacks, and they're found within hours, shared within a day and paid for long after the patch.
The Launch After the Launch
More and more big releases now arrive in two stages. The story ships first. Online follows weeks or months later, once the servers, the economy and the live team are ready.
Most people treat that second date as the smaller event. I think it's the riskier one.
When someone cheats in a single player game, they mostly spoil their own fun. The moment you add other players, shared progression and a marketplace, every shortcut has a price. Currency can be sold. Rare items can be traded. Ranks carry status. Accounts carry money.
And a small slice of your audience will stop playing the game and start playing your systems. Here's what that usually looks like.
Anatomy of an Exploit: The First Week Online
This is a composite, not one specific game. But every step in it is something we've seen play out across live launches.
- Hour 0. Online goes live. Players flood in, the servers hold, and the team breathes out.
- Hour 3. A player notices something odd. They dropped connection mid-trade, and when they reconnected, the item was still in their inventory. It was also in their friend's.
- Hour 6. They try it again on purpose. It works. They try it with currency. That works too.
- Hour 12. The method is shared in a private Discord. A few dozen players are now quietly duplicating rare items and currency.
- Day 1. Someone posts a clip. It hits TikTok, YouTube and Reddit. Thousands of players who never would have found the exploit now have step by step instructions.
- Day 2. Market prices start to slide. Items that took honest players weeks to earn are suddenly everywhere. Someone packages the method into a tool.
- Day 3. The studio confirms the issue and starts work on a fix. Support tickets pile up. Paying players ask why they bothered.
- Day 5. The patch lands. The bug is closed, but millions of duped coins and items are already in circulation. Now leadership faces the hardest call: roll back and punish everyone, or leave it and live with a broken economy.
The patch fixed the code. It didn't fix the damage. That's the part a pre-launch test is really buying you.
The Exploits We Find Most
Duplication is the headline, but it's rarely alone. These are the patterns that come up again and again in our online game engagements. Almost none of them need advanced skill. They need motivation and time, and your players have plenty of both.
They break the economy
Duplication through disconnects, trades or transactions processed twice. Race conditions, where several coordinated players tie up the server while one of them completes something that should have failed. The cost is inflation, crashed prices and an economy honest players stop trusting.
They lie to the server
If the server takes the client's word for what happened, players can forge damage, positions, match results and inventory. When traffic is intercepted, they can replay a reward claim, rewrite a purchase or skip a check entirely. The cost is free content, repeated rewards and a backend that can't tell real players from fake ones.
They skip the rules
Bypassing grinds, unlocking gated content early, boosting ranks and rigging matches. It sounds minor until it undermines the progression your retention and monetisation are built on, or the competitive integrity your most loyal players care about.
Notice what's missing: anything that needs a zero day. The damage comes from game logic, not from exotic hacks.
What's Actually at Stake
If you run a studio, your economy isn't a game system. It's your revenue model. Live service games earn over years, and that only works while players believe the economy is fair and their time and money are worth something. In a competitive game, integrity is the product. Once it breaks, players leave.
If you're a CISO, the online launch is the moment your game becomes a business platform with real money, real personal data and organised attackers. The questions you'd ask of any customer facing system now apply here: what does the client control, what does the server verify, and how far could an attacker get?
Either way, the maths is the same. Fixing a flaw before launch costs an engagement. Fixing it after costs a patch, a rollback debate, a support backlog, refunds and the trust of the players you most wanted to keep.
"Cyrex have been consistently great security testing partners for us across a number of complex projects. We are consistently impressed by the quality of work we see. Cyrex keeps us one step ahead of our attackers." Improbable
Five Questions to Answer Before Online Goes Live
Go back to the timeline. Every step after Hour 3 was avoidable if someone had asked these questions first.
- Does the server have the final say? Anything that touches inventory, currency, progression or match results should be decided and checked server side. If the server takes the client's word for it, assume someone will lie.
- What happens when a transaction is interrupted? Disconnects, timeouts and retries deserve the same scrutiny as the happy path. That's exactly where our Hour 3 player found the gap.
- What can someone change in transit? If your traffic can be read, replayed or rewritten, every request is a potential exploit. Strip what clients don't need and validate everything they send.
- How do small flaws chain together? The serious exploits usually combine issues that look harmless alone. Test the combinations, including what several coordinated players can do at once.
- What changed since the last test? New loot tables, currency changes, trading features and seasonal content all add new logic. Every update can reopen a door you thought was closed.
For complex multiplayer systems, start that conversation at least six to eight weeks before online goes live, so there's time to fix and retest.
Proof From the Field
Path of Exile 2 (Grinding Gear Games). Few games live or die by their economy like a hardcore online action RPG. Our engineers tampered with hundreds of client to server RPCs tied to core gameplay, from skill usage to item pickup, to check that nothing could be manipulated through crafted requests or altered traffic. We also reviewed the game binary for cheat enabling weaknesses, hardening the client and strengthening server side validation to protect the economy before launch.
Wayfinder (Airship Studios and Digital Extremes). We analysed the game's RPCs alongside its backend services, so the team could address what we found before going live.
"Their service was comprehensive, including analysis of game RPCs as well as backend services. The Cyrex team was effectively able to validate our work from a security standpoint and provided extremely valuable feedback we were able to address prior to Wayfinder going live." Digital Extremes
DOOM Eternal (Bethesda and id Software). Grey box testing across matchmaking, party and session handling, account creation, authentication, profiles, and achievement and reward validation. We found issues up to and including findings Bethesda classed as critical, then ran regression testing to confirm the fixes held.
Test It Like the People Who'll Break It
Exploit groups don't work alone. They collaborate, share findings and iterate in real time. Your testing should too.
Every Cyrex penetration testing engagement runs on Pair Hacking: a senior offensive engineer working alongside Deus Rex, our autonomous AI pentesting agent. Deus Rex covers the volume, mapping your attack surface, fuzzing protocols and chasing edge cases. The engineer brings the depth, chaining findings, abusing business logic and judging what genuinely matters.
For game traffic, we use Cyrex Protoceptor, our man in the middle technology. Most security tools only understand web traffic. Protoceptor steps into any communication between client and server, including UDP and TCP game traffic, custom binary protocols, real time state sync and launcher to backend calls. We intercept it, modify it, replay it and forge it, exactly as an attacker would. If gameplay authority lives on the client, we'll find it.
You don't get a list of vulnerabilities. You get a clear answer to the question that matters before you go online: how far could an attacker get, and what would they do when they got there?
Response within 5 days. NDA included. No commitment required.
Myths We Hear Before Every Online Launch
"Our anti-cheat will catch it." Anti-cheat watches the player's machine for known tools and odd behaviour. It can't fix a server that accepts bad data, and the most damaging exploits look exactly like legitimate play. If the backend trusts the client, an attacker doesn't need to beat your anti-cheat. They just need to send the right request.
"QA plays the game every day." QA checks that systems work as designed. Security testing asks whether they can be made to work in ways they weren't. QA confirms an item lands in your inventory when you pick it up. We ask what happens when that request is replayed a thousand times.
"We'll patch it if something comes up." You will, eventually. But exploits spread in hours and fixes take days, and a patch can't remove the currency already flooding your economy.
"Online is months away. There's no rush." That gap is the biggest advantage you'll get. A staggered launch gives you time to test your online systems properly. Use it, rather than treating the second launch as the smaller one.
Written by Tim De Wachter
Tim is CTO and Co-Founder of Cyrex, with a decade of experience shaping the company's technical direction across application security, game security, and high-load architectures. He leads Cyrex's security and load testing engineering teams with a focus on reverse engineering, complex systems, and the application of AI to security and testing workflows.
