Processor 'steal', the horrifying monster explained
As the 'steal' ~ "provider XYZ totally brutally overselling!!!!" posts pop up often times, especially in my reviews, I'll put what I just explained in a thread here in it's own thread to get the "steal! Overselling!!!" scare stories taken care of, hopefully once and for all.
Quick and short explanation: 'steal' tells about the OS's view which is based on an OS vCPU which is a HWT. With a VDS that is what you get, a full vCore as seen by the OS. So, on say, a 16 core Epyc with 32 hardware threads (HWT) the node OS sees 32 vCores.
A VPS's vCore however is a shared HWT, typically 25% or, if you are lucky 33% of a HWT (and even less than 25% with some products/providers).
'top' and similar utilities report from the OS's perspective, not from the VPS perspective, or, to be more precise, they assume that a vCore is a full vCore/HWT. VPS however are "fair share" that is, a provider packs e.g. 3 VPS vCores on a HWT and then talks about something like "2 vCPU, fair share 33%" - and if on such a VPS 'steal' shows even 60% that is normal and to be expected.
You don't like that, you want a full HWT for yourself? No problem, just buy a VDS.
Side note: don't we all like to have some "burst capacity" like e.g. "you may use up to double your vCPU share for up to 5 minutes per hour"? Now, where do you guess that capacity comes from? Unless you believe in fairy tales it should be clear that there are only 2 potential sources, (a) capacity held in reserve by the provider, so in our example a provider not selling 32 x 3 = 96 vCores but only say 90, and (b) the fact that the vast majority of VPSs aren't fully used anyway and hence there is almost always some unused capacity.
If you want to be smart then you'll log the 'steal' over a reasonable period of time, say 48 hours, at least once per second (ideally even 10 times per second) and check whether, and if so how much, the 'steal' is greater than 100 - 'fair share' (e.g. 33). Because that - and only that - would indicate overselling and even then only if it happens not just rarely to occasionally and for short period of time (because those cases would indicate burst being used).