Kernel-Level Anti-Cheat

Riot Games has introduced an on-demand mode for Vanguard, the anti-cheat system used in Valorant and League of Legends. The change gives players more control because the driver no longer has to stay active automatically when a PC starts up.For many Windows users, that is a meaningful shift. Vanguard has long been seen as intrusive, and the new mode allows the system to stop running after a game is closed instead of remaining in the background all the time.A compromise, not a redesignDespite the added flexibility, the core architecture of Vanguard remains unchanged. It is still a kernel-level anti-cheat system, which means it keeps the highest level of access Windows can grant to software.That level of access is what Riot says it needs to detect advanced cheats that operate outside the game. At the same time, the system’s proximity to the operating system has fueled ongoing debate about privacy, stability, and how far anti-cheat software should be allowed to reach into a player’s PC.The new mode is not available on every machine. Riot requires PCs to pass a “Vanguard Pre-Check” and meet modern hardware security standards such as TPM 2.0 and Secure Boot.If those protections are not enabled, users may need to change settings in the motherboard BIOS. In practice, the new convenience still comes with technical requirements that may not be simple for every player.Less background activity after gameplayThe most immediate benefit of on-demand mode is that Vanguard does not have to stay alive throughout the entire day. Once a session of Valorant or League of Legends ends, the anti-cheat can be turned off, reducing the amount of background processing on the system.For players who objected to Vanguard running from Windows startup, that creates a more acceptable compromise. Riot is keeping the same security model, but changing when the driver is allowed to remain active.Kernel-level access still raises concernsEven with the new flexibility, Vanguard is still far from a typical anti-cheat tool. Because it operates at the kernel level, it sits much closer to the core of Windows than ordinary applications do.Most players may never run into a problem, but conflicts with other drivers, Windows updates, or low-level software changes can have a bigger impact than a standard game crash. That is one reason Vanguard has remained controversial since launch.The criticism is not only about stopping cheats. It is also about the software’s position inside the operating system, where it can feel unusually sensitive to those who worry about system security and personal privacy.The on-demand mode does not remove that intrusiveness. It only changes when Vanguard runs, not how deeply it can access the system once active.Platform limits remain in placeThe update also does not create a path around Vanguard for players who want to avoid it by switching platforms. Valorant still does not support Linux because of the anti-cheat requirement.League of Legends is no different in practice. While the game can technically run on Linux through community-made tools, Vanguard still blocks that route.The change therefore focuses mainly on Windows convenience. The platform restrictions tied to Vanguard remain in place, and Riot is not backing away from the architecture that enforces them.For players who only wanted Vanguard to stop running after shutdown, the update is a practical improvement. For those who have long objected to kernel-level access or the lack of Linux support, the core concerns remain untouched.In that sense, the new mode makes Vanguard less disruptive in everyday use, but it does not change the debate over how much authority anti-cheat software should have on a PC. Source: tech.sportskeeda.com

Vanguard No Longer Has to Run at Startup, but Riot Keeps Its Deepest Access