Vanguard On-Demand Mode: What Changed and Why It Matters
Vanguard on-demand mode is an optional way of running Riot’s kernel-level anti-cheat where its driver only loads when you launch Valorant or League of Legends, instead of starting with Windows and staying resident from boot, giving players more control over when deep system monitoring is active while keeping the same security model during actual game sessions. This change is not a small tweak; it is Riot finally acknowledging that the central complaint about Vanguard was never its existence, but its constant presence. By decoupling Vanguard from the boot process, Riot is conceding that players deserve a say in when kernel-level anti-cheat runs. That alone is a philosophical shift: trust is now something you opt into with your hardware and settings, not something forced on you every time your PC powers on.
From Always-On to Optional: Riot’s Answer to Years of Pushback
Riot is giving its Vanguard anti-cheat an optional on-demand mode, so the driver launches with Riot games instead of at system boot. That always-on requirement has been the main sticking point since Vanguard arrived with Valorant in 2020 and later expanded to League of Legends, with players upset that a kernel-level anti-cheat sat in their tray whenever their PC was on. Turning this into a choice is Riot’s attempt to repair that broken trust. Crucially, if you ignore the new option, nothing changes: Vanguard still runs from boot and behaves exactly as it does now. The company is not throwing out its security posture; it is admitting that blanket enforcement was a blunt tool. Giving players the option to tie Vanguard to game sessions is a pragmatic compromise between security and autonomy rather than a backpedal.
The Hardware Catch: Vanguard Pre-Check and Modern PC Security
The on-demand mode comes with a clear catch: Vanguard Pre-Check, a list of hardware and security requirements your PC must meet before you can switch. You need at least Windows 11 25H2, Secure Boot, TPM 2.0, virtualization-based security, and an IOMMU enabled, often through UEFI and BIOS menus that the software cannot change for you. Riot says around 34–35 percent of players already qualify out of the box, about 65 percent can usually get there by toggling BIOS settings, and roughly 3 percent would need hardware upgrades to participate at all. This is Riot drawing a line: if you want Vanguard on-demand mode, you must invest in a modern, locked-down platform. It is voluntary trust segmentation, privileging up-to-date machines while leaving older systems to the more invasive always-on model. In opinion terms, that feels fair but unapologetically forward-looking.
Why Now: Microsoft Collaboration and the ‘Who Loads First’ Problem
The shift is only possible because of work Riot did with Microsoft’s Xbox OS Security Team on the Windows kernel. Previously, Vanguard had to start at boot to solve what Riot calls the “who loads first” problem: a vulnerable driver could load, map a cheat into the kernel, then unload before any anti-cheat arrived. Newer Windows builds introduce the Runtime Driver Attestation Report, which lets Vanguard query a secured list of every driver loaded since boot through the TPM, even if it was not running at the time. That record can be extended but not altered without breaking the trust chain. In other words, the OS finally gives kernel-level anti-cheat the visibility it lacked, so Riot can afford to be less intrusive in how early Vanguard runs. This is the right direction: rather than demanding constant surveillance, the anti-cheat taps into the platform’s own integrity mechanisms.
What Players Should Do Next—and What It Signals for Cheating
Practically, your next step is straightforward: update your Riot client, run Vanguard Pre-Check, and see whether you qualify for on-demand mode. If you are in the roughly 34–35 percent that already meet the requirements, you will see a button to enable Vanguard on-demand; everyone else has to decide whether BIOS changes or eventual hardware upgrades are worth the tradeoff. This is not just a quality-of-life feature. Riot reports that cheaters still appear in about 0.7 percent of PC ranked matches, with kernel-level cheats the most common method. The company plans to keep focusing on how cheats reach the kernel rather than chasing each individual hack, and hints that more checks may arrive for top ranks or unusual devices. The conclusion is clear: Riot wants a future where stronger platform security lets kernel-level anti-cheat be present only when needed, without giving up on catching cheats.
