Conclusion
Copy protection is here to stay, for as long as game developers are eating food. No copy protection is perfect. Developers know this, and as long as they can have the game uncrackable for a few weeks or days into launch, forcing people to buy it, it's a job well done. Denuvo achieves this at the cost of requiring Internet access during activation and limiting hardware changes in a short period of time (which makes life difficult for hardware reviewers).
Another gotcha is what happens with the game when the activation servers are down or gets turned off a decade from now. You would have paid for the game, but might not be able to play it. At least system security, data protection, and privacy doesn't seem to be an issue with Denuvo, though, unlike other copy protection mechanisms. Some developers have also begun removing Denuvo in later patches, which is a great methodology as it ensures initial sales, yet addresses some of the points we just mentioned.
Let's address the elephant in the room first. We did not find Denuvo to make a tangible performance difference with Devil May Cry 5.
This is not a sweeping statement applicable to all games because Denuvo isn't a "one size fits all" DRM solution. Capcom is using Denuvo in what seems to be the best-possible manner—letting it do code-verification, piggy backing on a low-power part of the game engine that has minimal performance impact either way; it's entirely possible another developer will implement Denuvo differently (read: poorly), resulting in a higher performance impact. For example, nothing stops naive developers from putting the Denuvo checks into their rendering code to ensure every single frame is "protected", which of course will end up massively reducing framerate. I do suspect that Denuvo ships significant documentation and "implementation tips" with their libraries to avoid exactly that, though.
The RTX 2080 Ti is the fastest graphics card we have, and we've put it through three resolutions at decreasing CPU clock-speeds. Framerates scale down almost linearly below a clock-speed at which the CPU begins to pose a bottleneck. This happens with both Denuvo on and off and is simply due to the fact that the CPU cannot generate frame information as quickly as the GPU could render them. For 1080p, this saturation point is 3.50 GHz, for 1440p it's 2.50 GHz, and for 4K it's 1.50 GHz. In all GPU-limited scenarios we tested, the impact of Denuvo is completely negligible with well below 1% and indistinguishable from "Denuvo off" for a human that's playing the game. Only when the game is CPU limited did we start seeing performance losses pop up, which are in the range of 3-4% and, surprisingly, fairly constant across all scenarios we tested.
We checked for this behavior not only with the high-end GeForce RTX 2080 Ti, but also with the mainstream Radeon RX 580, which is the current 1080p champion at around the $200-mark, and observed no surprises. Even bona-fide high-end AMD solutions such as the Radeon VII don't behave differently.
In yet another round of tests, we looked at Denuvo's performance impact with different CPU configurations and found no big losses there either—the performance hit stays constant at 3-4%. It's also worth mentioning that nearly every gamer PC will be running in a GPU-limited situation, or you'd have wasted money on a graphics card that's too fast for the given CPU. Considering that graphics card performance "costs more" than CPU performance, this is an unlikely scenario.
I can now hear you asking "but what about the 20 FPS difference found by a user on Steam forums?". It seems the answer to that question lies in how the Denuvo-free version of DmC 5 works. The Steam version stores the savegame and settings in "C:\Program Files (x86)\Steam\userdata\[user id]\601150\remote\win64_save", whereas the Denuvo-free version stores its data in the game's folder in a subdirectory called just "win64_save", even if you plop the new EXE straight into the Steam installation folder. So, when switching from the Steam version to the Denuvo-free version the first time, all settings are lost and the game will auto-configure itself. Devil May Cry 5 uses very conservative details settings by default even when high-end hardware is detected, so it's plausible that this would lead to the large performance difference observed in such a quick, uninformed test.
It appears that Capcom has found the right way to implement Denuvo—piggybacking on a low-intensity part of the game's logic. Our testing should restore confidence of paying gamers who worry that pirates enjoy a better experience. Gabe Newell famously commented that the best way to beat pirates is to offer a better service than them, one that overwhelms even their promise of "a free product". The gaming industry has become increasingly online multiplayer, in which game servers are able to validate paying customers. However, game protection solutions such as Denuvo still seem to be a necessary evil for games with tangible offline experiences, such as single-player campaigns. We conclude that at least with Devil May Cry 5, paying customers won't get a slower product.
If you have ideas for further testing, please do let us know in the comments section.