Vanguard on-demand mode, explained in plain language
Vanguard on-demand mode is an optional setting for Riot’s kernel-level anti-cheat that makes the software launch only when a Riot game starts and shut down after you stop playing, instead of loading at Windows boot and running in the background all the time, as long as your PC passes specific modern security checks.
Riot Games has begun rolling out this Vanguard on-demand mode for Valorant and League of Legends, letting the driver launch only when a Riot title opens instead of loading at system start, a change that went live on June 24 and is built around a hardware security gate called Vanguard Pre-Check. In practice, this means that once your system qualifies, Vanguard no longer sits in your system tray from the moment Windows boots; it appears only when you click Play and exits when you close the client. This is not Riot suddenly going soft on cheats; it is Riot finally admitting that the always-on requirement that arrived with Valorant in 2020 and later expanded to League was a bad deal for players, and giving us a way to disable always-on Vanguard without walking away from ranked queues entirely.
Why Riot can afford to stop camping your kernel now
For years, Riot insisted Vanguard had to run at boot to solve what it called the “who loads first” problem: a shady driver could sneak into the kernel before the anti-cheat, inject a cheat, then unload itself so it would never appear in any later scan. The only way to guarantee trust was to be there from the first millisecond. That decision clogged taskbars and stoked paranoia, but it did plug a real security gap.
The game changer is work Riot did with Microsoft’s Xbox OS Security Team. Newer Windows builds now include a Runtime Driver Attestation Report, a TPM-backed log of every driver loaded since boot, which anti-cheats can query even if they were not present when those drivers started. If someone tampers with that record, the chain of trust breaks and the data is effectively useless, closing the “who loads first” loophole without Vanguard needing to babysit your PC from startup. This is the technical backbone that makes a Riot anti-cheat optional outside of game sessions instead of a permanent system resident.
Vanguard Pre-Check: who qualifies and what your PC needs
Here is the catch: Vanguard on-demand mode is locked behind Vanguard Pre-Check, a bundle of security requirements that your PC must meet before you can disable always-on Vanguard. The minimum operating system is Windows 11 25H2, not because Riot is chasing the latest version for fun, but because the driver attestation report only exists there and, as Philip Koskinas bluntly put it, “it gets more convenient to cheat the older your operating system is”.
| Requirement | What it enables |
|---|---|
| Windows 11 25H2 or later | Provides the Runtime Driver Attestation Report needed for on-demand checks |
| UEFI mode & Secure Boot | Verifies the Windows bootloader and blocks bootkits during load |
| TPM 2.0 | Stores keys and backs the attestation process via a secure cryptoprocessor |
| VBS & HVCI | Isolates secure memory and validates kernel code before execution |
| IOMMU | Acts as a firewall between PCIe devices and system memory to stop DMA abuse |
Most new PCs ship with these features enabled, and Riot says about 34 to 35 percent of players already pass Vanguard Pre-Check out of the box, with that “fully secured” bucket growing by roughly 1 to 2 percent per month. The remaining 65 percent will need to tweak BIOS settings, and about 3 percent of weekly players are on hardware that cannot meet the requirements at all without upgrades. As Koskinas describes it, Pre-Check is “proactive, voluntary trust segmentation for genuine hardware and real players,” and Riot has been clear that the feature is optional for now, not a forced gate on the entire player base.
How to switch to Vanguard on-demand mode, step by step
If you are in the lucky slice of players whose systems already meet Vanguard Pre-Check, the switch to Vanguard on-demand mode is refreshingly painless. According to Riot’s own breakdown, “players who already satisfy the Pre-Check requirements will get the button to switch into on-demand mode with their next update,” and can then make Vanguard launch when the game does and remain running only while playing a Riot title.
- Update Windows to at least version 11 25H2 and install the latest Riot client and game patches so the Pre-Check tools are present.
- Enter your motherboard’s UEFI/BIOS and enable Secure Boot, TPM 2.0, Virtualization-Based Security (often under virtualization or security tabs), HVCI, and IOMMU if your hardware supports them.
- Reboot into Windows, launch your Riot game, and open the Vanguard Pre-Check interface, which will verify all requirements and, if passed, expose a toggle or button to enable on-demand mode for Vanguard.
- Turn on Vanguard on-demand mode; from this point, the driver will no longer run at boot and will instead load only when a Riot title starts, shutting down after you leave the game session.
If you do nothing, nothing changes: Vanguard will continue to load at boot and sit in your system tray around the clock, because Riot has deliberately kept the anti-cheat optional outside of game time rather than forcing BIOS-level changes on players who are not ready for them.
What this means for cheaters, ranked players, and Riot’s next move
Riot’s own numbers show that cheaters appear in roughly 0.7 percent of all PC ranked matches across Valorant and League of Legends, with kernel-level cheats still the most common method. That is not a crisis-level infection rate, but it is persistent enough that any move perceived as “relaxing” Vanguard will make some ranked grinders nervous. The truth is more nuanced: on-demand mode changes when Vanguard runs, not what it can see in the kernel, and Riot is betting that a stricter hardware trust model offsets the reduced runtime window.
Koskinas has described Pre-Check as the start of a longer campaign, signalling that more checks could be added over time, and that mandatory gates may eventually appear in the “most competitive segments, on unusual devices, or at the highest ranks”. For now, the next thing to watch is how many players move into the fully secured bucket and how Riot responds once on-demand adoption climbs, especially since the company has already named pixelbots as its next big focus. The broader lesson is clear: if you want Riot anti-cheat optional outside of game sessions, you are going to have to live with a more tightly locked-down Windows install, and the studio seems convinced that is a trade both serious players and the health of their ranked ladders can live with.
