Introduction
Riot Vanguard is the anti-cheat that comes with VALORANT and League of Legends, and the best-known example of kernel-level anti-cheat: software that installs a driver into the core of Windows, the layer that runs the operating system itself. That is a lot of access for a game, and the same questions come up every time another title asks for it. What can the anti-cheat see? Is it safe to keep on the PC? Why do games now also want Secure Boot and TPM 2.0?
In short, a kernel driver can see more than any app, and Riot says it uses that position mainly to check that the PC has not been tampered with. The risks are real and specific, and most have documented cases behind them. The field is also moving. Anti-cheat increasingly asks the hardware to prove how the PC booted instead of watching from inside the kernel from the moment Windows starts, and the most expensive cheats have moved to a second computer.
What Is Kernel-Level Anti-Cheat?
Windows runs code in two modes. Apps run in user mode, each with its own private memory, so when one crashes the others keep going. The core of the system and its drivers run in kernel mode, where, in Microsoft's words, "all code that runs in kernel mode shares a single virtual address space". A kernel driver can read the memory of any program and see every other driver that loads. If it crashes, Windows goes down with it, which is what a blue screen is.
Cheats got there first. A cheat running as a kernel driver can read the game's memory while hiding from everything above it, and a normal app has no reliable way to inspect code that sits below it. Kernel-level anti-cheat is the answer to that: a driver that watches what touches the game, paired with an app that talks to the game's servers. Riot describes Vanguard in exactly those terms, as "a client that runs while our games are active along with a kernel mode driver".
Kernel-level anti-cheat games list
Most competitive PC shooters use one of these six. The column that matters most for safety is when the driver starts.
| Anti-cheat | Used in | Driver starts | Secure Boot / TPM 2.0 |
|---|---|---|---|
| Riot Vanguard | VALORANT, League of Legends | With Windows by default; on demand as an option since June 2026 | VALORANT on Windows 11: both. League: TPM 2.0 |
| RICOCHET (Activision) | Call of Duty: Black Ops 7, Warzone, Modern Warfare 4 | With the game, stops when you exit | Both |
| EA Javelin | Battlefield 6 and other EA games | With the game | Battlefield 6: both |
| Easy Anti-Cheat (Epic) | Fortnite, Apex Legends and many others | With the game | Up to each game |
| BattlEye | PUBG, Rainbow Six Siege and others | With the game | Not required by BattlEye itself |
| FACEIT Anti-Cheat | Counter-Strike 2 on FACEIT | With Windows | Both, with IOMMU and VBS being phased in |
Why Does Riot Vanguard Start Before Windows?
Riot calls it the "Who Loads First?" problem. An anti-cheat that starts with the game arrives after everything else has had time to prepare. In Riot's 2026 explanation, "a vulnerable driver could simply run before the game did, map in a sophisticated cheat, and then completely unload itself, hiding indefinitely from anything that might load after." A driver that loads at boot is already there when anything else arrives.
Riot also describes what the driver does while it waits: "Vanguard is not really 'running all the time.' The driver loads at boot, but nothing is making calls to it, and there's no network connectivity until you run one of Riot's games." In the same 2024 post Riot says the driver is not there to gather data ("we can already see everything we need to from user-mode") but "to confirm the game is currently running in an environment we can trust."
Part of that check is a local list of drivers with known security holes. In 2020 the list made Vanguard block some fan controllers, temperature monitors and overclocking tools, because their drivers allowed arbitrary writes to memory, the same kind of door a cheat uses. Riot narrowed the list after the backlash, but in 2026 some storage and Wi-Fi drivers still trigger an "incompatible driver" error.
RICOCHET, Javelin, Easy Anti-Cheat and BattlEye made the other choice: their drivers load with the game and unload when it closes. Only Vanguard (by default) and FACEIT start with Windows.
Vanguard On-Demand: no driver at boot on a locked-down PC
In June 2026 Riot made boot-time loading optional. On a PC that passes its Pre-Check (Windows 11 version 25H2 or newer, Secure Boot, TPM 2.0, IOMMU, virtualization-based security and memory integrity), "Vanguard's driver component will no longer launch when the system starts." Riot calls the mode "100% optional". It is possible because those hardware features can prove what happened during boot without the anti-cheat watching, which the Secure Boot section below explains.
What Can Vanguard Anti-Cheat See on Your PC?
A kernel driver can technically see everything on the machine, so the useful question is what the vendor says it collects. Riot's FAQ is more specific than most. It states that "we're not shipping back your files or documents", and that signature scans for known cheats return "only true or false". When a program tries to send input to the game, the answer is mostly yes or no plus the name of that process. Vanguard also logs the file path of every library loaded into the game, and Riot notes that a path can contain your Windows user name; that data stays in "warm" storage for 14 days. Finally, Vanguard fingerprints the device, which Riot ties to boosting, smurfing and account theft, and the privacy notice lists "unique device IDs" and automated decisions such as account suspensions.
The same FAQ admits a limit: "I can't tell you every single thing Vanguard looks at." A full list of checks would also be a map for cheat developers.
Other vendors describe a similar scope. BattlEye's privacy policy lists your IP address, hardware identifiers such as serial numbers, running processes and drivers, and game- and system-related files and memory, and notes that file names can contain your user name and that BattlEye has "the theoretical capability to transmit flagged executable code". Easy Anti-Cheat collects limited technical data while the game runs plus hardware identifiers to stop ban evasion, and generally deletes detection data within 30 days. EA's policy mentions a "fingerprint" or "hash" of your machine's components.
None of these policies mentions screenshots, browsing history or personal documents. They cover your hardware, what runs next to the game, and the memory and files that touch it. A kernel driver could technically do more, so the safety question is partly about trust.
Is Kernel-Level Anti-Cheat Safe?
"Is it safe" covers three questions: can it crash the PC, can someone use it against you, and does it behave like malware.
A bug in the kernel takes Windows down
On July 19, 2024, a faulty update to CrowdStrike's security software sent millions of Windows PCs to a blue screen. CrowdStrike makes an enterprise security sensor, not an anti-cheat, and the crash came from an out-of-bounds memory read in its kernel driver. Any kernel driver carries the same kind of risk, because, as Microsoft's documentation puts it, "if a kernel-mode driver crashes, it causes the entire operating system to crash." A careful vendor can only make that rare.
The fear that Vanguard can "brick" a PC has no evidence behind it. When League of Legends started requiring Vanguard in 2024, some players could no longer boot, and Riot traced those cases to firmware settings changed to meet the new requirements: a disk with an old partition layout switched to UEFI mode, or a graphics card whose firmware was not signed for Secure Boot. Riot stated that "Vanguard does not and cannot make changes to the BIOS itself", and told Kotaku it had not confirmed any instance of Vanguard bricking hardware.
Anti-cheat drivers as a weapon
A signed driver with a security hole is a way into the kernel, which makes it useful to attackers. The technique is called "bring your own vulnerable driver". It needs administrator rights to load the driver, so it is a step after a break-in. Anti-cheat drivers have been used this way several times:
- In 2022 Trend Micro found ransomware using
mhyprot2.sys, the anti-cheat driver of Genshin Impact, to shut down antivirus. "Genshin Impact does not need to be installed on a victim's device for this to work." The attackers brought the driver with them. - CVE-2024-22830 described a flaw in
ACE-BASE.sys, the driver of Anti-Cheat Expert, that let a regular user raise their rights to System. - CVE-2025-61155 covered
GameDriverX64.sysfrom Tower of Fantasy, which let a program end any process, security software included, without administrator rights. Fortinet reported the Interlock ransomware group using it in 2026.
One case is easy to misread. In 2026 ESET described ransomware tools disguised as Vanguard, FACEIT and EA's anti-cheat, which sounds like "ransomware used Vanguard". It did not. Each variant "impersonates a different product and abuses a different malicious or vulnerable driver", and the file named like Vanguard's driver was actually Tower of Fantasy's.
Windows has a defence for this. Microsoft's vulnerable driver blocklist has been on by default since the Windows 11 2022 update and is enforced whenever memory integrity is on. The current list blocks specific builds of BattlEye's driver BEDaisy.sys, several of Genshin Impact's mhyprot drivers and older builds of Anti-Cheat Expert, along with the driver of the cheating tool Cheat Engine. Microsoft notes that the list "isn't guaranteed to block every driver found to have vulnerabilities". BattlEye's own FAQ says Windows 11 still blocks its driver when kernel-mode hardware-enforced stack protection is switched on.
Is Vanguard a rootkit?
In 2024 two researchers from St. Pölten University of Applied Sciences compared four anti-cheats with the traits of rootkits, the malware that hides inside the kernel. By their metrics FACEIT and Vanguard were "rootkit-like", BattlEye and Easy Anti-Cheat showed only minor similarities, and "no anti-cheat system shows signs of network manipulation". The study rated behaviour such as hiding and deep hooks rather than intent, and it relied on published analyses by security researchers and cheat developers instead of its own reverse engineering.
What you can do
- Uninstall the anti-cheat of games you no longer play. Removing a game does not always remove its driver, and a vulnerable driver is useful to an attacker whether you play or not. Vanguard has its own entry, Riot Vanguard, in the list of installed apps.
- Keep memory integrity on. It is the Windows setting that also enforces the vulnerable driver blocklist, and Battlefield 6 and Riot's on-demand mode already ask for it.
- Leave Secure Boot on, even if a game or a tool suggests turning it off. Microsoft gives the same advice for the 2026 certificate change described below.
- Install anti-cheat only through the game or its launcher. An "anti-cheat update" or a "Vanguard installer" from anywhere else is what the impersonating ransomware looked like.
Why Games Now Require Secure Boot and TPM 2.0
VALORANT has asked for TPM 2.0 and Secure Boot on Windows 11 for years, and since 2025 others have followed. Battlefield 6 requires both. Call of Duty limits PCs without them to a few modes in Black Ops 7 and Warzone and keeps them out of online play in Modern Warfare 4. FACEIT requires both for Counter-Strike 2 on its platform. Microsoft's Xbox team expects more: "you'll see more titles requiring features like TPM, Secure Boot, and advanced protections such as VBS."
What Secure Boot does
Secure Boot is a firmware feature that checks the signature of each piece of code that starts the computer before running it. Riot describes its main job as "verifying the Windows bootloader, preventing bootkits that would corrupt the operating system as it is being loaded from disk." A cheat that loads before Windows, the oldest way to hide from an anti-cheat, now has to get past that signature check. EA's Battlefield team is careful about the effect: "Secure Boot isn't a silver bullet to stop all cheating; but it is a barrier in of itself and enables other barriers." Windows shows whether it is on in System Information, on the line called Secure Boot State.
What TPM 2.0 adds
A TPM is a small security chip, either a separate module or part of the processor's or chipset's firmware, and it gives an anti-cheat two things. During a measured boot it records a fingerprint of every component that starts and can hand over a signed report of that record, which FACEIT calls "a cryptographically signed, tamper-proof report" and the industry calls attestation. Each TPM also carries an endorsement key written into it at the factory, which Riot describes as "an extremely non-fungible form of hardware ID". A banned cheater cannot generate a new one.
Activision checks those reports on Microsoft's Azure servers because a check on the PC itself could be spoofed. It is also clear about the limit: "TPM 2.0 enhances system trust at Windows boot up, but it is not a real-time monitoring or enforcement anti-cheat system." TPM proves how the PC started and says nothing about the match.
From boot-time drivers to attestation
With Secure Boot and a TPM, the anti-cheat no longer has to sit in the kernel from the first second to know that nothing slipped in during boot. Epic put it in one line when it announced Easy Anti-Cheat Linux v2 in October 2026: TPM "enables an application like anti-cheat to know what code ran at boot without running at boot itself." Vanguard's on-demand mode rests on the same idea, and Epic's Linux version works with no kernel module at all.
Microsoft is pushing the same way. After the CrowdStrike crash it began moving antivirus products out of the kernel, and in 2025 The Verge reported that it was also talking to game developers about using the kernel less. Microsoft's security lead David Weston said many of them "would love to not have to maintain kernel stuff". Microsoft also says it will keep supporting third-party kernel drivers, so kernel-level anti-cheat is not going away soon, but less of it has to run before Windows does.
Secure Boot certificates expiring in 2026
Secure Boot relies on certificates stored in the firmware, and three Microsoft certificates from 2011 run out in 2026: two in June, and Windows Production PCA 2011, which signs the Windows boot manager, on October 19. Microsoft says devices without the newer 2023 certificates "will continue to start and operate normally", but stop receiving new protections for the early boot process, and warns that "Secure Boot should not be disabled to work around certificate expiration." Neither Microsoft nor any game vendor has linked the expiry to anti-cheat checks. The certificates arrive through Windows Update.
How DMA Cheats Work, and How IOMMU Stops Them
DMA stands for direct memory access. Graphics cards, network cards and other devices on the PCIe bus read and write the computer's memory directly, without asking the processor each time, which is what makes them fast. A DMA cheat abuses that: a card in the gaming PC reads the game's memory and passes it to a second computer, where the cheat runs with no anti-cheat on it at all. Epic's lawsuit against a Fortnite tournament player put it simply: "DMA cheats, however, use two computers to operate." Epic detected the card in 2024, and in 2025 the court found that the DMA device and a hardware spoofer had bypassed both Fortnite's anti-cheat and its hardware bans.
These setups are rare because of what they cost. Riot's anti-cheat lead wrote in 2026 that "kernel-level cheating continues to be the most popular way", because DMA and screen-reading cheats "both typically require extra hardware", and Activision says DMA hardware and services push the price of cheating up.
IOMMU: a firewall for memory
The defence is already in the processor. An IOMMU (VT-d on Intel, AMD-Vi or simply IOMMU on AMD) controls which parts of memory each device may reach. FACEIT describes it as "a firewall for your RAM that limits what plug-in devices can access". With the IOMMU on, Vanguard can "mark game memory as unreadable", so a card's attempt to read it ends in a hardware fault instead of data. Riot has been placing full IOMMU restrictions on high-ranked VALORANT players caught with DMA devices. In May 2026 it clarified that "Vanguard does not damage hardware or disable your devices": the card stops working only while the IOMMU is on, and the IOMMU is required to play.
The protection has gaps. Some devices do not support it yet, and in December 2025 Riot's anti-cheat team found that firmware on motherboards from ASUS, Gigabyte, MSI and ASRock reported DMA protection as active without correctly setting up the IOMMU, leaving memory open before Windows loaded (CERT/CC VU#382314). Windows' Kernel DMA Protection is a separate feature: it guards external ports such as Thunderbolt and works only after the operating system has loaded.
Second-PC cheats that never read memory
Another two-computer cheat never touches memory. A capture card sends the game's video to a second PC, a machine-learning model finds targets on the image, and a small device poses as the mouse or controller and moves the aim. Nothing runs on the gaming PC, so no driver can see it, but it only knows what is on the screen and cannot show enemies behind walls. Catching it is a matter of behaviour: Activision now looks at "how inputs behave, not which device is plugged in", and Riot's anti-cheat lead said back in 2021 that kernel drivers "have never been the most important tool in our arsenal."
What Is a Hardware Ban (HWID Ban)?
A hardware ban blocks the device rather than the account, so a new account on the same PC is blocked too. It is why anti-cheats collect hardware identifiers, and why the TPM's factory key matters to them.
The rules differ by publisher. Riot's support page says it bans "the physical components of that computer rather than just banning an account", for any account on a Riot platform or game. Riot's anti-cheat lead described a narrower practice in October 2026: at most four months, limited to the game where the cheating was detected. Activision's written policy is the strictest. A hardware ban applies to the device, can extend to past and future Call of Duty games, varies in length and is "not eligible for appeal", and players are told to be careful when "purchasing, borrowing, or using secondhand, shared, or publicly accessible devices."
That warning has a story behind it. In 2026 a player who bought a used processor said VALORANT refused to start because of the previous owner's ban. Riot's anti-cheat lead doubted the claim, noting that Riot does not ban every other component when one matches.
Kernel Anti-Cheat on Linux and Steam Deck
Easy Anti-Cheat and BattlEye have supported Linux through Valve's Proton since 2021, but each game decides whether to turn that on, and many have not. Riot never supported Linux, writing that it "does not currently afford us sufficient ability to attest boot state or kernel modules", and EA blocked Linux in Apex Legends in 2024 after finding it a path for cheats.
Epic's Easy Anti-Cheat Linux v2, announced in October 2026, follows the attestation model above. It "does not install or load an anti-cheat kernel module" and instead requires a signed kernel and modules, TPM 2.0, Secure Boot, measured boot and an IOMMU, with Fortnite as the first game. Handhelds are left out for now: "The Steam Deck does not support the required features for our EAC v2 solution." A system that does not qualify gets an error message rather than a ban.
FAQ
Is Riot Vanguard spyware?
No published evidence shows Vanguard collecting personal files, browsing history or screenshots, and Riot states that it does not ship files or documents. It does collect device identifiers, the names of programs that interact with the game and the paths of libraries loaded into it.
Can Riot Vanguard brick your PC?
There is no confirmed case. The 2024 boot failures came from firmware settings changed to meet the TPM and Secure Boot requirements, and Riot states that Vanguard cannot change the BIOS.
Does VALORANT need Secure Boot and TPM 2.0?
On Windows 11, yes. VALORANT shows error VAN 9001 when TPM 2.0 is off and VAN 9003 when Secure Boot is off. Windows 10 is still supported. League of Legends asks for TPM 2.0 but, unlike VALORANT, not for Secure Boot.
How do I uninstall Riot Vanguard?
Remove it like any other program, from the list of installed apps. Riot's games will not start without it and reinstall it the next time you launch one. Because the driver normally loads at boot, turning it off or back on needs a restart.
Do all anti-cheats start with Windows?
No. Riot Vanguard (unless on-demand mode is on) and FACEIT load at boot. RICOCHET, EA Javelin, Easy Anti-Cheat and BattlEye start with the game and stop when it closes.
Will my PC stop booting when the Secure Boot certificates expire?
No. Microsoft says devices without the 2023 certificates keep starting and working normally but miss new protections for the boot process. Keep Windows Update on and leave Secure Boot enabled.
Can anti-cheat detect DMA cards?
Increasingly, yes. Epic detected one in a tournament PC, Riot and FACEIT use the IOMMU to keep game memory out of a card's reach, and EA added protection against DMA hardware in 2026.
Sources
- Vanguard On-Demand, Riot Games, June 2026.
- /dev: Vanguard x LoL, Riot Games, April 2024.
- Microsoft recommended driver block rules, Microsoft Learn.
Anti-cheat asks one question about your PC: is it telling the truth about itself?
Websites ask the same about your browser. Run the Privacy & Trust Index check to see whether your browser's User-Agent, platform and hardware agree, the way its Device Integrity card checks them, and read how sites catch a mismatch in the guide to user agent spoofing detection.