Vanguard On-Demand: The Anti-Cheat That Stops Living in Your Tray
Riot Vanguard on-demand mode is a new anti-cheat setting that lets the kernel-level Vanguard driver load only when a Riot game launches, instead of starting with Windows and running in the background at all times, provided your PC passes a security-focused hardware and firmware compatibility check.
Riot Games has started rolling out an on-demand mode for Vanguard, the kernel-level anti-cheat used in Valorant and League of Legends, so the driver launches only when a Riot title opens instead of at system boot, with the change going live on June 24. In practice, that means the infamous system tray icon disappears unless you are in a match, and the driver shuts down after you stop playing. This is not a cosmetic tweak; it is Riot’s overdue answer to years of criticism about an always-on anti-cheat sitting in the kernel and consuming resources even when players were not gaming.
Riot has not weakened Vanguard; it has finally admitted that security and user control do not have to be in permanent conflict. On-demand mode keeps the kernel hooks but moves them out of your daily desktop life. For players worried about performance, stability, or privacy, that is a meaningful philosophical shift, not a “quality-of-life” bullet point.
How Riot Vanguard On-Demand Works Under the Hood
On-demand mode changes Vanguard’s schedule, not its rank. The driver is still kernel-level, still aggressive, and still aimed squarely at cheats that sneak code into the lowest layers of Windows. The difference is when that code is allowed to run: with Pre-Check satisfied, Vanguard no longer launches when Windows starts, but instead loads when you open a Riot game and shuts down when you stop playing.
Previously, Vanguard insisted on boot-time launch to solve what Riot calls the “who loads first” problem: a vulnerable driver could quietly load before the anti-cheat, map a cheat into the kernel, then unload itself, leaving no trace for a later anti-cheat to detect. The always-on requirement was less about paranoia and more about maintaining an unbroken chain of trust from boot to match start.
The breakthrough comes from work with Microsoft’s Xbox OS Security Team and a new Runtime Driver Attestation Report in modern Windows builds, which lets Vanguard query a secure, TPM-backed list of every driver loaded since boot, even if Vanguard was not there to watch in real time. That log cannot be edited without breaking the chain, so Vanguard can finally afford to sleep until your anti-cheat mode launch is tied to the game. This is Riot betting that better platform security beats brute-force surveillance.
Vanguard Pre-Check and the New Hardware Line in the Sand
The catch is unapologetically hardware-driven. To disable always-on anti-cheat and switch to Riot Vanguard on-demand, your PC must pass Vanguard Pre-Check, a test of modern security features rather than raw FPS. At minimum, you need Windows 11 25H2, UEFI mode with Secure Boot, TPM 2.0, Virtualization-Based Security (VBS) with Hypervisor-Protected Code Integrity (HVCI), and an IOMMU enabled.
According to Riot’s anti-cheat lead Philip Koskinas, “the driver attestation report was only initially added in this version, but it’s also because, due to the natural progression of security, it gets more convenient to cheat the older your operating system is”. Riot says about 34–35 percent of players already meet all Vanguard hardware requirements out of the box, the remaining 65 percent mostly need to flip BIOS switches, and roughly 3 percent would require a hardware upgrade to qualify.
This is where the trade-off bites. On-demand is completely optional; if you do nothing, Vanguard keeps running at boot as before. But the message is clear: if you want more privacy and lighter idle systems, you must align your PC with Microsoft’s security stack. That is less a technical constraint and more a nudge to retire lax configurations that make kernel cheats easier to write.
Performance, Privacy, and the Real-World Player Impact
For ordinary players, the impact of Riot Vanguard on-demand is mostly about peace of mind and system headroom. With Pre-Check satisfied, there is no kernel driver lingering from boot while you are browsing, working, or gaming elsewhere; it appears when the game does and exits when you are done. For anyone whose machine disliked Vanguard—crashes, conflicts, or weird device issues—that alone could be reason to revisit Valorant or League.
The move also answers long-standing complaints that an always-on anti-cheat had no business living in the kernel 24/7 and watching a PC’s every move. It does not erase privacy concerns—kernel drivers are still powerful, and Vanguard remains off-limits to Mac and Linux—but it reduces the window in which Riot’s code has that power. That is a non-trivial concession from a publisher whose anti-cheat once defined itself by its uncompromising presence.
Riot reports that cheaters appear in roughly 0.7 percent of all PC ranked matches across League of Legends and Valorant. That number is not low enough to declare victory, but it shows that heavy-handed approaches did have teeth. On-demand mode will now test whether those teeth remain sharp when the anti-cheat’s footprint shrinks during the rest of your computing life.
A New Anti-Cheat Philosophy: Optional Trust, Not Blanket Surveillance
The deeper story here is philosophical. Vanguard Pre-Check is described as “proactive, voluntary trust segmentation for genuine hardware and real players,” with Riot hinting that more checks may arrive over time, but kept optional except in the highest ranks, on unusual devices, or in the most competitive segments. That is a far cry from the old model of one-size-fits-all kernel surveillance.
Riot’s stated strategy is to focus on the ways cheats inject code into the kernel rather than chasing individual hacks, the same principle that underpins attestation-backed on-demand mode. Once a larger share of players move into the fully secured bucket—which is currently around 34 percent and growing by 1–2 percent per month—Riot has already named pixelbots as the next focus area.
This is the new bargain: if you give your PC a modern security foundation, Riot will stop insisting on an always-on anti-cheat. It is an overdue compromise that still respects competitive integrity. Players win back some control and idle performance; Riot gains a cleaner, attested kernel environment. In a landscape where PC anti-cheat often feels like a tug-of-war, Vanguard on-demand looks like the rare truce that might hold.
