Warden is one of the oldest anti-cheat systems still in active service. It has guarded World of Warcraft since the game's earliest years, and it works very differently from the kernel anti-cheats that dominate newer titles.
A scanner inside the game
Warden does not install a kernel driver. It runs as a module inside the WoW process itself, in user mode. From there it scans the game's memory and the system around it for the signatures of known cheats — and it does this repeatedly while you play.
Updatable on the fly
Warden's strength is that Blizzard can update it without patching the game. It periodically downloads fresh scan modules from Blizzard's servers, so the checks it runs today are not the checks it ran last month. That keeps an old anti-cheat current against new cheats.
How bans work
Blizzard issues bans for confirmed cheating, and is known for ban waves — large batches of accounts actioned together rather than one at a time. WoW bans are primarily account-level. Because Warden runs in user mode and focuses on memory scanning, its enforcement centres on the account and its detected behaviour rather than building the firmware-level hardware fingerprint that kernel anti-cheats favour.
A piece of history
Warden is also historically important: it was at the centre of early public debate about how much an anti-cheat is allowed to see on a player's PC. That conversation, years ago, is the same one now had about kernel anti-cheat — Warden simply had it first.
The takeaway
Warden shows that effective anti-cheat predates the kernel era. It is an in-process, frequently-updated memory scanner, account-focused in its bans — a reminder that the kernel-level approach is one strategy among several, not the only way to police a game.