Riot Games just flipped the script on one of gaming's most controversial security tools. Starting today, League of Legends and Valorant players can switch Vanguard from an always-on kernel-level watchdog to an on-demand system called Vanguard Pre-Check. The move comes after a collaboration with Microsoft's Xbox OS Security Team to harden Windows' kernel against the exploits that cheaters typically use, according to Phillip Koskinas, Riot's head of anti-cheat. It's a significant shift for a company that's faced player backlash over Vanguard's invasive boot-time launch since 2020.
Riot Games is giving players what they've been asking for since 2020 - control over when its Vanguard anti-cheat runs. The new Vanguard Pre-Check system lets League of Legends and Valorant players switch off the kernel-level driver that's been auto-launching at boot time since the tool's controversial debut.
The change goes live today, but there's a catch. Players need compatible hardware and must opt into what Riot calls "pre-boot security mechanisms and Windows' own native protection features." That requirement stems from a collaboration with Microsoft's Xbox OS Security Team, which helped develop Windows kernel improvements that lock down the driver and memory exploits cheaters typically abuse.
"Riot is able to introduce this new feature now after working with the Xbox OS Security Team at Microsoft on improvements to the Windows kernel," Phillip Koskinas, Riot's head of anti-cheat, wrote in the company's blog post. The partnership represents a rare case of a game publisher directly influencing operating system security architecture.
Vanguard has been a lightning rod since Riot introduced it to Valorant in 2020, then expanded it to League of Legends in 2024. The system operates at the kernel level - the deepest layer of Windows - giving it sweeping access to monitor running processes and block suspicious drivers. That depth is what makes it effective against sophisticated cheats, but it's also what made players uncomfortable.
Critics have long argued that kernel-level anti-cheat represents an overreach, essentially giving game companies the same system privileges as antivirus software. Security researchers have pointed out that if Vanguard gets compromised, attackers could exploit that kernel access for devastating effect. Riot's always maintained the risk is worth the reward, citing dramatically lower cheat rates in Valorant compared to competitors.
But the company clearly heard the pushback. With Vanguard Pre-Check, the driver stays dormant until players actually launch a Riot game. Behind the scenes, Microsoft's kernel hardening does the heavy lifting - closing off the attack vectors that would normally require Vanguard's constant vigilance.
The technical details matter here. Modern cheats often work by loading malicious drivers before anti-cheat systems initialize, or by exploiting memory vulnerabilities to hide their presence. Windows' new protections apparently address enough of these vectors that Riot feels comfortable letting Vanguard sleep until game time.
This isn't just a win for privacy-conscious players. It could reshape how the gaming industry thinks about anti-cheat architecture. If Microsoft's kernel improvements prove effective, expect other publishers to follow Riot's lead. Epic Games, Activision, and Bungie all use similar kernel-level systems in Fortnite, Call of Duty, and Destiny 2 respectively.
The timing is notable too. Windows 11 has been pushing users toward more locked-down security configurations, including TPM 2.0 requirements and Secure Boot. Riot's hardware requirements for Vanguard Pre-Check likely align with these same specs, meaning the company is betting on a future where most gaming PCs have robust built-in protections.
For players, the practical impact is immediate. No more Vanguard blocking random drivers at startup. No more wondering what that kernel-level process is doing when you're not gaming. And critically, no more choosing between playing Riot's games and running software that conflicts with Vanguard - a common complaint from users who work in IT or security fields.
But Riot isn't making this mandatory. Players can still run Vanguard the old way if they prefer or if their hardware doesn't meet the requirements. That flexibility is smart - it lets the company test whether the new approach works without risking a cheat epidemic if something goes wrong.
The collaboration with Microsoft's Xbox team adds another wrinkle. Xbox has been trying to unify PC and console gaming experiences, and kernel-level security improvements benefit both platforms. If these Windows changes make it easier to stop cheaters without intrusive anti-cheat software, that's a win for Microsoft's broader gaming ambitions.
Riot's move to make Vanguard optional marks a turning point in the anti-cheat wars. By partnering with Microsoft to harden Windows at the kernel level, the company found a way to give players control without sacrificing security. If it works, expect the rest of the industry to demand similar OS-level protections - and that could finally end the era of always-on kernel anti-cheat. For now, Riot's betting that better Windows security plus on-demand monitoring beats the old approach of constant surveillance. Players who've been waiting years to disable Vanguard at boot are about to find out if that bet pays off.
