Lina Hope
For six years, the relationship between Riot Games and its Valorant player base has been defined by a singular, persistent friction point: the Vanguard anti-cheat driver. Since the tactical shooter’s inception in 2020, Vanguard has functioned as a kernel-level sentinel, burrowing into the operating system at the moment of startup and remaining active, monitoring processes, and consuming system resources regardless of whether the user was playing a match or browsing the web.
On June 24, Riot Games officially signaled a turning point. Following years of sustained community outcry, the developer announced that Vanguard is moving to an "on-demand" mode. This shift marks a significant technological compromise between the company’s uncompromising stance on competitive integrity and the user base’s demands for privacy and system autonomy.
The Chronology of Contention: A Six-Year Standoff
The history of Valorant is inextricably linked to the history of Vanguard. When Riot launched the title, the landscape of competitive shooters was being decimated by sophisticated "wallhacks," "aimbots," and DMA (Direct Memory Access) devices that bypassed traditional software-based anti-cheat detection. Riot’s solution was radical: a kernel-mode driver that initialized before almost every other process in Windows.
2020: The Launch and the Backlash
Upon its release, Vanguard was immediately criticized as invasive. Privacy advocates and security researchers questioned the wisdom of allowing a third-party application to operate at the highest privilege level of the Windows kernel 24/7. Riot defended the move as a "necessary evil," arguing that modern cheat developers were clever enough to load malicious drivers before anti-cheat software could initialize. If Vanguard wasn’t there at startup, the argument went, the battle was already lost.
2021–2023: The "Always-On" Normalization
Despite the outcry, Riot held its ground. Over the intervening years, the controversy simmered. While the community continued to voice concerns about system performance, boot times, and potential security vulnerabilities introduced by a permanent kernel driver, Riot pointed to the relatively low rate of successful high-level cheating in Valorant compared to competitors like Counter-Strike or Call of Duty. The argument became a stalemate: players wanted privacy; Riot wanted a "clean" ecosystem.
2024: The Breakthrough
The stalemate finally broke not through a change in policy, but through a technological advancement. By collaborating with Microsoft’s Xbox OS Security team, Riot found a way to bridge the gap between security and convenience. The result is the new on-demand mode, allowing the driver to remain dormant until the moment a user launches a Riot-sanctioned title.
The Technological Leap: Runtime Driver Attestation
The fundamental problem with disabling an anti-cheat is the "pre-game window." If an anti-cheat only starts when the game starts, a sophisticated attacker could load a malicious driver into the kernel, perform their nefarious tasks, and then unload that driver before the anti-cheat is even active. By the time the game initializes, the "dirt" has been swept under the rug.
Riot’s new solution, detailed in their June 24 post, hinges on a feature called Runtime Driver Attestation.
How It Works
Rather than relying on active monitoring, the system now utilizes a "Pre-Check" protocol. When a user launches a Riot game, the system performs a cryptographic handshake with the operating system, verifying that no unauthorized drivers have been loaded or executed since the last system boot.
This verification relies on the integration of modern security standards:
- Windows 11 25H2: The latest architecture requirements.
- Secure Boot: Ensuring that the boot process hasn’t been tampered with by rootkits.
- TPM 2.0 (Trusted Platform Module): Providing a hardware-level root of trust.
- IOMMU: Restricting DMA access, which is a common vector for high-end hardware cheats.
- Virtualization-Based Security (VBS): Isolating the kernel to prevent unauthorized access.
By validating the state of the machine at the moment of launch, Riot can be mathematically certain that no cheat drivers were active during the session, rendering the "always-on" requirement obsolete for those who meet these hardware standards.
Supporting Data: The Accessibility of the New Mode
Critics of the new policy have pointed to the steep hardware requirements. Currently, Riot estimates that roughly 35% of their total player base meets the "Vanguard Pre-Check" criteria to run the anti-cheat in on-demand mode. While this may seem like a minority, Riot notes that this figure is growing by 1–2% each month as older hardware is retired and users upgrade to Windows 11.
For the remaining 65% of players, the experience remains unchanged for now. Those on older hardware or those unable to meet the specific security requirements will continue to use the always-on version of Vanguard. This tiered approach is a strategic move by Riot to maintain a baseline of security across their entire global user base while incentivizing the adoption of more secure, modern computing environments.
Official Responses and Corporate Strategy
Riot’s communication regarding this shift has been careful to frame the move as an evolution of security rather than a concession. In their official statement, Riot engineers emphasized that the "always-on" requirement was never about spying on users, but about the specific technical limitations of Windows security protocols at the time of Valorant’s release.
"We have always listened to our players," a spokesperson noted in the announcement. "The goal was always to provide a fair playing field. If we can achieve that same level of integrity without running the driver 24/7, then that is the superior path forward for everyone."
This shift also follows a more aggressive posture Riot has taken against hardware-based cheaters. In May 2024, the company made headlines for successfully targeting and rendering "brick-like" the DMA hardware used by high-end cheat developers. Riot’s public stance—joking that these expensive pieces of hardware had effectively become "$6K paperweights"—demonstrates a shift toward a more proactive, hardware-centric security strategy.
Implications: A New Standard for Anti-Cheat?
The implications of this move extend far beyond Valorant. For years, the gaming industry has been trapped in a "security vs. privacy" arms race. If Riot’s implementation of Runtime Driver Attestation proves successful, it could provide a roadmap for other developers.
1. The Death of the "Invasive" Label?
If other major publishers, such as Activision-Blizzard or Epic Games, adopt similar collaborative measures with Microsoft, the stigma surrounding kernel-level anti-cheats could dissipate. By moving to a state-based verification model, the industry can satisfy privacy concerns while maintaining the integrity of competitive play.
2. The Pressure on Hardware Manufacturers
This shift puts significant pressure on the PC hardware ecosystem. By making features like TPM 2.0 and IOMMU "performance-critical" for gamers, Riot is effectively driving the adoption of more secure computing standards. This could lead to a future where Windows systems are inherently more secure simply because the gaming industry demands it.
3. Setting the Bar for Competitive Integrity
Riot has effectively raised the bar. By proving that a major developer can scale back its footprint without sacrificing security, they have put other studios on notice. The "always-on" argument, once considered the only way to combat cheaters, is now being exposed as a legacy approach that can be bypassed through better OS integration.
Conclusion: The Path Ahead
For the average Valorant player, the transition to on-demand Vanguard is a victory of user experience. It signifies a move toward a more respectful relationship between software and the hardware it occupies. However, it also underscores the growing necessity for modern, standardized hardware in the competitive gaming world.
As Riot continues to roll out this feature, the focus will shift to how quickly the "Pre-Check" criteria can be met by the wider player base. If the company can successfully transition the majority of its users to this on-demand model within the next two years, it will have not only solved a PR headache but will have also pioneered a new, more sustainable standard for digital competitive integrity.
The standoff that lasted six years is finally thawing, and in its place, a more nuanced, technically sophisticated future for anti-cheat software is beginning to take shape. While the "always-on" era is not yet fully extinguished, the horizon is finally clear, pointing toward a world where the game, and only the game, is what matters when you hit "Play."
Sagoh
Rifan Muazin
