SourceThe Verge•Stalecollected in 1m
Riot enables on-demand mode for Vanguard anti-cheat
#kernel-security#anti-cheat#windows-apivanguardriot gamesvanguardmicrosoftwindows
Learn how Riot and Microsoft are evolving kernel-level security to balance anti-cheat performance with user control.
30-Second TL;DR
What Changed
Vanguard anti-cheat can now be set to on-demand mode
Why It Matters
This update demonstrates how kernel-level security can be balanced with user privacy and system performance through OS-level integration. It sets a precedent for how high-privilege software can interact with Windows security features.
What To Do Next
Review how your high-privilege applications handle kernel-level access and explore Microsoft's latest security APIs for safer, on-demand execution.
Who should care:Developers & AI Engineers
Key Points
- •Vanguard anti-cheat can now be set to on-demand mode
- •Requires pre-boot security and native Windows protection features
- •Developed in collaboration with Microsoft Xbox OS Security Team
Deep Insight
AI-generated analysis for this event — not the original article.
Enhanced Key Takeaways
- •The on-demand mode leverages Windows Virtualization-Based Security (VBS) and Hypervisor-Enforced Code Integrity (HVCI) to maintain system integrity without requiring a constant kernel-level driver presence.
- •This shift addresses long-standing privacy and performance concerns from the player base regarding Vanguard's previous requirement to run at system startup regardless of whether the game was active.
- •Riot Games implemented this change to align with modern Windows security standards, moving away from the 'always-on' driver model that previously caused compatibility issues with certain third-party software and hardware configurations.
- •The collaboration with the Microsoft Xbox OS Security Team signifies a broader industry trend where game developers and OS vendors work together to secure the kernel-user boundary for anti-cheat purposes.
- •Players who do not meet the strict hardware and software requirements for the on-demand mode (such as TPM 2.0 and Secure Boot) must continue to use the traditional always-on Vanguard driver to play Riot titles.
Competitor Analysis
Kernel Access
- Riot Vanguard (On-Demand)
- Optional (On-Demand)
- Easy Anti-Cheat (EAC)
- Mandatory (Always-On)
- BattlEye
- Mandatory (Always-On)
OS Integration
- Riot Vanguard (On-Demand)
- Deep (VBS/HVCI)
- Easy Anti-Cheat (EAC)
- Standard Driver
- BattlEye
- Standard Driver
Primary Focus
- Riot Vanguard (On-Demand)
- Riot Ecosystem
- Easy Anti-Cheat (EAC)
- Multi-Platform/Third-Party
- BattlEye
- Multi-Platform/Third-Party
| Feature | Riot Vanguard (On-Demand) | Easy Anti-Cheat (EAC) | BattlEye |
|---|---|---|---|
| Kernel Access | Optional (On-Demand) | Mandatory (Always-On) | Mandatory (Always-On) |
| OS Integration | Deep (VBS/HVCI) | Standard Driver | Standard Driver |
| Primary Focus | Riot Ecosystem | Multi-Platform/Third-Party | Multi-Platform/Third-Party |
Technical Deep Dive
- Utilizes Windows Virtualization-Based Security (VBS) to create an isolated memory region for security processes.
- Leverages Hypervisor-Enforced Code Integrity (HVCI) to ensure only signed, verified code can execute in the kernel.
- Requires TPM 2.0 and Secure Boot to be enabled to verify the integrity of the boot chain before the anti-cheat can operate in on-demand mode.
- The driver is dynamically loaded and unloaded by the Windows kernel only when the game executable is launched and verified, reducing the attack surface during non-gaming sessions.
Future ImplicationsAI analysis grounded in cited sources
Other major anti-cheat providers will adopt VBS-based on-demand models.
The success of Riot's collaboration with Microsoft sets a new security standard that reduces user friction and privacy complaints, pressuring competitors to follow suit.
Riot will eventually deprecate the always-on driver entirely.
As hardware requirements like TPM 2.0 become ubiquitous in the PC gaming market, the need for a legacy always-on driver will diminish, allowing Riot to simplify their security architecture.
Timeline
2020-04
Riot Games launches Vanguard anti-cheat alongside the Valorant closed beta.
2020-05
Riot updates Vanguard to allow users to disable the anti-cheat via the system tray, though it still required a reboot to re-enable.
2024-05
Riot expands Vanguard to League of Legends, sparking renewed debate over kernel-level access.
2026-06
Riot officially introduces the on-demand mode for Vanguard in collaboration with Microsoft.
- 2020-04Riot Games launches Vanguard anti-cheat alongside the Valorant closed beta.
- 2020-05Riot updates Vanguard to allow users to disable the anti-cheat via the system tray, though it still required a reboot to re-enable.
- 2024-05Riot expands Vanguard to League of Legends, sparking renewed debate over kernel-level access.
- 2026-06Riot officially introduces the on-demand mode for Vanguard in collaboration with Microsoft.
Weekly AI Recap
Read this week's curated digest of top AI events →
Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: The Verge ↗
This is a summary, not the original. Read the source, or get the weekly briefing.
The weekly digest
One email a week. Unsubscribe anytime.