I Have 200 Machines — How to Prioritize Which Ones Need Anti-Cheat First

In September 2024, I received a call from an operator running a chain of six arcades across Manila. He had just completed an audit of his 217 machines and discovered that 34 of them had been modified — tampered boards, bypassed coin acceptors, and in three cases, complete foreign motherboard swaps. His monthly revenue was down approximately 28 percent from the same period the previous year. He did not know where to start. He asked me one question that I have heard at least forty times since: “Which machines do I fix first?”

This is not a small problem. Large arcade operators — whether running 50 machines or 500 — rarely have the budget, time, or technical staff to retrofit every machine simultaneously. The challenge is triage: identifying which machines represent the greatest financial risk and addressing them in order of priority. This article lays out the triage framework I have developed over the past decade, refined through deployments in the Philippines, Dubai, and several large sites in Latin America.

The Core Problem: You Cannot Fix Everything at Once

When an operator discovers that their fleet has been compromised, the instinct is to lock everything down immediately. This instinct is understandable but operationally impractical. A full fleet retrofit across 200 machines requires hardware procurement, technician scheduling, machine downtime, and coordination with third-party board suppliers. Even with a dedicated in-house technical team, you are looking at weeks — possibly months — of work.

The real problem is that during those weeks, the most vulnerable machines continue to leak revenue. Worse, word spreads among the cheating community. If your highest-payout fish table is still unprotected, you will attract the same individuals who drained it last month. The order in which you apply protection matters enormously.

I have seen operators start with the machines that are easiest to reach — the ones closest to the technician’s workbench, or the ones that happen to have accessible spare parts. This is a mistake. Accessibility has zero correlation with financial risk. A machine that is physically convenient to repair but generates 3 percent of your revenue should never take priority over a machine generating 18 percent of your revenue, even if that machine requires a two-hour trip across town.

How the Risk Scoring Framework Works

The triage framework I use assigns each machine a composite risk score based on four weighted factors.

Factor 1: Revenue Contribution (Weight: 40%). For each machine, calculate its average daily revenue as a percentage of total venue revenue. A machine that contributes 8 percent of daily earnings is simply more important than one that contributes 0.5 percent. Use actual data — coin counter readings, ticket redemption logs, or POS-linked play records. If your machines are not instrumented for per-unit revenue tracking, start there. Without per-machine data, you are triaging blind. In a Dubai mall arcade I worked with in 2023, three fish table machines accounted for 47 percent of total monthly revenue across a 90-machine floor. Those three machines were the entire business. Every other machine — the racing simulators, the crane games, the redemption counters — existed to provide variety and foot traffic. If those three fish tables had been compromised, the operator would have lost nearly half his income before noticing anything on the aggregate numbers.

Factor 2: Cheat Vulnerability Index (Weight: 35%). Not all machine types face the same threat profile. I assign each machine a cheat vulnerability index (CVI) from 1 to 10 based on machine category, hardware generation, and known exploit history. Fish table and fish hunter machines (CVI 9-10) are the highest-target machines globally. They combine high cash-in/cash-out velocity with complex game logic that offers multiple attack surfaces — memory manipulation, packet injection, payout table modification. In the Philippines and across Southeast Asia, fish tables are attacked more than any other machine type by a factor of roughly 6 to 1. Slot-style and reel-based machines (CVI 7-8) have well-understood exploit patterns around RNG manipulation and coin acceptor bypasses. Older IGT and Aristocrat platforms running unpatched firmware are especially vulnerable. Redemption and ticket-based games (CVI 4-6) are often overlooked because the theft vector is indirect — attackers manipulate jackpot triggers or sensor calibration to generate excess tickets, then redeem for high-value prizes. Crane and claw machines (CVI 2-3) face lower-tech mechanical attacks: voltage manipulation to alter claw grip strength, or physical tampering with payout settings. Kiddie rides and non-revenue machines (CVI 0-1) are rarely targeted for direct financial exploitation but can serve as network entry points.

Factor 3: Known Compromise Indicators (Weight: 20%). This is binary in concept but requires investigative work. Has this specific machine shown any signs of tampering? The indicators include: physical evidence (broken cabinet seals, non-factory screws, unexplained drill holes near the logic board area, or scratch marks around the service door lock); electronic evidence (unexpected software versions, presence of unauthorized daughterboards, modified BIOS settings, or MAC addresses on the network that do not match the machine’s factory registration); behavioral evidence (a machine that consistently pays out above statistical expectation, or a machine where the coin counter and the game’s internal audit log disagree by more than 3 percent); and pattern evidence (the same player or group of players repeatedly gravitating to specific machines, winning at rates that would be statistically improbable over a 30-day sample). If a machine has two or more of these indicators, it receives the full 20% weighting. Machines with zero indicators receive 0% in this category but are not exempt — the other three factors still apply.

Factor 4: Network Position (Weight: 5%). This is a smaller weighting but can be decisive in edge cases. Some machines sit on shared network segments with high-value machines. A compromised crane machine may not lose much revenue directly, but if it shares a VLAN with your fish tables, it functions as an open door. I have documented cases in Dubai where attackers used a poorly secured kiddie ride’s network connection to pivot into the fish table network segment, then modified payout tables across six machines before anyone noticed.

Applying the Framework: A Worked Example

Suppose you have these three machines in your arcade:

• Machine A: Fish table generating $180/day (18% of revenue), CVI 9, tampered seals found — one known indicator. Score: (0.40 x 18) + (0.35 x 9) + (0.20 x 10) + (0.05 x 5) = 7.2 + 3.15 + 2.0 + 0.25 = 12.6
• Machine B: Redemption game generating $45/day (4.5% of revenue), CVI 5, no indicators. Score: (0.40 x 4.5) + (0.35 x 5) + (0.20 x 0) + (0.05 x 0) = 1.8 + 1.75 + 0 + 0 = 3.55
• Machine C: Crane machine generating $30/day (3% of revenue), CVI 2, shares network with fish tables (network position 7). Score: (0.40 x 3) + (0.35 x 2) + (0.20 x 0) + (0.05 x 7) = 1.2 + 0.7 + 0 + 0.35 = 2.25

The triage order is clear: Machine A first, then Machine B, then Machine C. The framework makes explicit what experienced operators know intuitively: protect the highest-revenue, most-vulnerable machines first.

Execution Strategy: How to Actually Roll This Out

Having a priority list is not the same as executing on it. Here is the rollout approach that has worked across multiple large arcade deployments:

Week 1: Protect your top 10 highest-scoring machines. These represent your largest revenue concentration. Use your best technician, work after hours, and get every machine fully verified and protected before the venue reopens. The goal is to stop the largest leak first. In a 200-machine arcade, the top 10 machines typically represent 40-60% of total revenue.

Week 2: Protect the next 20 machines. By this point, the highest-scoring machines are protected, and the remaining vulnerability is spread across a larger number of lower-impact machines. Focus on machines with CVI scores above 7, even if their revenue contribution is modest.

Week 3-4: Protect the remaining machines, plus add monitoring modules to all networked machines regardless of their individual score. A single unprotected networked machine can provide a backdoor into machines you have already protected. This phase also includes a second verification pass on the Week 1 machines to ensure the protection is still active and has not been tampered with.

FAQ

Q: What if I discover new indicators on a machine after I have already set my priorities?

A: Recalculate. The framework is dynamic because your threat landscape is dynamic. If a machine shows new tampering evidence or an unusual payout spike, its score changes immediately. Update your priority list weekly during the rollout period. I have seen cases where a machine that was priority #47 suddenly jumped to #3 because a technician discovered a modified EEPROM during a routine maintenance check.

Q: My machines do not have per-unit revenue tracking. What do I do?

A: Estimate from coin counter readings. Even a rough estimate — Machine A fills two cash boxes in a week, Machine B fills half of one — is better than no estimate. Prioritize adding per-machine coin counters or electronic meters to your next machine purchase or retrofit. Until then, use your best judgment based on which machines have the longest player queues and which games have the highest stakes.

Q: Should I shut down the highest-risk machines until I can protect them?

A: If a machine shows clear evidence of active exploitation and the loss per week exceeds the revenue it generates, yes — take it offline until it is protected. This is a rare situation (usually only when a single machine is losing 50 percent or more), but it does happen. The lost revenue from taking it offline for three days is less than the lost revenue from running it unprotected for another month. In one Manila arcade, the operator continued running a compromised fish table for three weeks while waiting for a technician. The total loss during those three weeks exceeded the cost of the anti-cheat module by a factor of 12.

Q: How do I convince my business partner that this prioritization is correct?

A: Show them the numbers. Calculate the daily revenue loss for your top 5 machines if they were fully compromised. Compare that to the cost of protecting them. The return on investment is typically 300-500% in the first year alone. Most business partners will agree once they see that the question is not “can we afford to protect these machines?” but “can we afford not to?”

What to Do Next

Build your machine inventory spreadsheet today. Add columns for daily revenue estimate, machine type, CVI score, and any known indicators. The framework syntax is simple enough to implement in a spreadsheet in under an hour. Once you have your scores, schedule your top-10 protection work for this week. The machines at the top of your list are vulnerable right now. Every day you spend building the list instead of acting on it is a day those machines continue to be targets.