Riot Vanguard is a kernel-level anti-cheat developed by Riot Games. Vanguard initially released as the anti-cheat used for Valorant on April 7th, 2020. Originally designed for Windows only alongside Valorant, the console edition of Valorant released in June 2024 has an anti-cheat using the same branding, however this anti-cheat functions very differently. Vanguard has received much criticism because of its intrusive nature. Vanguard was introduced into League of Legends on April 11th, 2024.
On Windows, Vanguard runs primarily as a kernel-level anti-cheat to target more advanced cheating techniques. This method runs at a lower system level than regular programs, which makes it more difficult for cheats to avoid detection. Kernel-level monitoring has been questioned because of its potential security risks.
Critics have stated that providing the anti-cheat system with higher system privileges could be vulnerable since the higher access could be exploited by attackers. Riot justifies kernel-level scanning despite such problems by claiming that this is the way that existing cheating practices can be detected.
Vanguard On-Demand
Vanguard On-Demand, released June 24th, 2026, is an update which makes Vanguard only run when a game is open, and close afterwards. However, this is only possible with the following security requirements, collectively known as Vanguard Pre-Check requirements, enabled:
According to Phillip Koskinas, the chief of anti-cheat at Riot Games, this feature was not possible at release as before this time, Windows and PC hardware have not had sufficient security features to make this possible.
DMA cards are among the most widely documented methods of cheating in Valorant. They work by directly reading and/or modifying the game's memory, which is why enabling IOMMU causes this method to stop working. Shortly after the update's release, Riot Games posted on their official X account congratulating the owners of a "brand new $6,000 paperweight," referring to the now-useless DMA devices. The post caused concern among players that Vanguard was capable of permanently damaging hardware, which Riot denied, stating that they "would not and cannot" use Vanguard to brick personal computers.
HWID bans
In October 2026, any secondhand hardware previously used by someone who had cheated on any Riot Vanguard-powered game may result in bans when a new owner booted Valorant or League of Legends for the first time.
Dorner, Christoph; Klausner, Lukas Daniel (2024-07-30). "If It Looks Like a Rootkit and Deceives Like a Rootkit: A Critical Examination of Kernel-Level Anti-Cheat Systems". Proceedings of the 19th International Conference on Availability, Reliability and Security. ARES '24. New York, NY, USA: Association for Computing Machinery. pp.1–11. arXiv:2408.00500. doi:10.1145/3664476.3670433. ISBN979-8-4007-1718-5.
Collins, Sam; Poulopoulos, Alex; Muench, Marius; Chothia, Tom (2024-11-19). "Anti-Cheat: Attacks and the Effectiveness of Client-Side Defences". Proceedings of the 2024 Workshop on Research on offensive and defensive techniques in the context of Man At The End (MATE) attacks. CheckMATE '24. New York, NY, USA: Association for Computing Machinery. pp.30–43. doi:10.1145/3689934.3690816. ISBN979-8-4007-1230-2.
