Vanguard On-Demand Mode: A Big Shift for Riot’s Anti-Cheat
Vanguard on-demand mode is Riot’s new optional setting for its kernel-level anti-cheat, changing Vanguard from an always-on driver that loads at system boot into one that only launches when a Riot game starts and shuts down when play ends, provided specific Windows security requirements are met on eligible PCs. This is not a small tweak; it is a philosophical shift in how Riot balances security with player control. For years, the anti-cheat’s constant presence in the system tray has been the central complaint from players who dislike invasive, always-on software guarding their machine. By making Vanguard on-demand, Riot is finally acknowledging that trust is earned not only through catching cheaters, but through respecting how gamers want their PCs to behave.
The change went live on 24 June 2026, rolling out across Valorant and League of Legends, and it is fully optional. If players ignore it, Vanguard continues to run exactly as before, loading at boot and remaining active around the clock. That is the key takeaway: Riot is offering a path to reclaim control without walking away from the kernel-level protection it believes is required to keep cheaters out.
Why Riot Can Finally Ditch Always-On Boot Protection
Riot did not abandon the always-on model out of sudden generosity; it did so because Windows finally gives it a safer alternative. Historically, Vanguard had to start at boot to solve what Riot calls the “who loads first” problem: a vulnerable driver could load before the game, map a cheat into the kernel, then unload itself, disappearing before any anti-cheat started. Keeping Vanguard resident from the first moment of boot was its way to maintain an unbroken trust chain. That approach worked, but it also meant the anti-cheat was glued to your system whether you were gaming or just browsing.
What makes the on-demand model possible now is work Riot did with Microsoft’s Xbox OS Security Team, which led to newer Windows builds gaining a Runtime Driver Attestation Report accessible through the system’s TPM. This secured record lists every driver loaded since boot and can only be extended, not altered, so tampering breaks the trust chain. In other words, Vanguard no longer needs to be present from the start to know what touched the kernel. This is a smarter, attestation-backed model that allows Riot to keep focusing on how cheats reach the kernel rather than chasing every single cheat file.
Vanguard Requirements: Who Qualifies for On-Demand Mode
Here is the catch: Vanguard on-demand mode is gated behind a hardware and OS security checklist Riot calls Vanguard Pre-Check. To switch to on-demand, your PC must run at least Windows 11 25H2 and have modern security features enabled, including Secure Boot, TPM 2.0, virtualization-based security, and related protections. According to Riot, “about 34 percent of players already meet everything out of the box, most of the rest can get there by flipping some BIOS settings, and around 3 percent would need a hardware upgrade to qualify at all.” This is voluntary trust segmentation: players on newer, properly configured hardware get more control and a tidier experience.
| Vanguard requirement | What it does | Why it matters |
|---|---|---|
| Windows 11 25H2 or later | Supports Runtime Driver Attestation Report. | Enables Vanguard to audit drivers without running from boot. |
| UEFI Mode & Secure Boot | Verifies the Windows bootloader and blocks bootkits. | Helps ensure the system starts in a trusted state. |
| Trusted Platform Module 2.0 | On-board cryptoprocessor backing driver attestation. | Stores keys and secures the attestation log. |
| Virtualization-Based Security & HVCI | Isolates secure memory and checks kernel code before execution. | Raises the bar against kernel-level exploits. |
| Input-Output Memory Management Unit | Firewall between PCIe devices and system memory. | Blocks direct memory access abuse from devices. |
Koskinas estimates that roughly 35 percent of players already satisfy the Pre-Check requirements, and a separate figure from Riot puts the fully secured group at around 34 percent, growing by 1 to 2 percent per month. The remaining 65 percent will mostly need to enable these settings in BIOS, while about 3 percent of weekly players lack one or more hardware features entirely and would need new hardware to qualify. Riot is explicit that no one is being forced to change anything; on-demand mode is an option, not a mandate.
How to Enable Vanguard On-Demand and What It Means for Players
If your system passes Vanguard Pre-Check, enabling on-demand mode is meant to be straightforward. Koskinas says players who already satisfy the requirements will see a button to switch into on-demand with their next Vanguard update. Once enabled, Vanguard’s driver component stops launching when Windows starts and instead loads only when you open a Riot title, shutting down after you stop playing. The visible result is basic but meaningful: the system-tray icon disappears unless a Riot game is running, and the anti-cheat no longer sits in your taskbar around the clock. That alone addresses years of complaints about invasive, always-on anti-cheat software piggybacking on every session, gaming or not.
This change also reframes the relationship between players and anti-cheat. Cheaters still appear in roughly 0.7 percent of PC ranked matches across Valorant and League of Legends, with kernel-level cheating the most common method. Riot’s response is not to loosen security, but to tie stronger protection to systems that meet explicit Vanguard requirements while leaving others on the legacy model. The message is clear: if you want a more flexible anti-cheat runtime, you need to accept modern security standards on your hardware.
The Future of Riot Anti-Cheat: Optional Today, Stricter Tomorrow?
Vanguard on-demand mode feels like a win for players, but it also sets the stage for a stricter future. Koskinas describes Pre-Check as proactive, voluntary trust segmentation for genuine hardware and real players, and hints that Riot may add further checks over time. For now, the system stays optional except in the most competitive segments, on unusual devices, or at the highest ranks. That caveat matters: esports-level and edge-case setups may eventually see Pre-Check become mandatory rather than a nice-to-have.
The next metric to watch is how quickly players move into the fully secured bucket, with Riot already naming pixelbots as the next focus once on-demand adoption grows. In practical terms, the company is betting that more modern hardware and attestation-based security will give it enough confidence to keep kernel-level anti-cheat while easing the worst pain points for players. Vanguard on-demand mode is not a retreat from aggressive anti-cheat; it is Riot deciding that the best way to keep cheaters out is to build deeper trust with the people who are not cheating.
