For nearly five years, Riot’s Vanguard has been the poster child for the anti-cheat overreach debate: a ring-0 driver that boots with Windows, runs whether you’re playing or not, and reserves the right to brick peripherals it doesn’t like. The pitch was always that persistence is the point — cheats load early, so the cop has to clock in earlier. Critics countered that a kernel-level process running 24/7 on millions of consumer PCs is a juicy target dressed up as a feature.
This week Riot blinked, sort of. A new “on-demand” mode lets Vanguard spin up only when you launch League of Legends, Valorant, or another title that requires it, then shut down on exit. It’s the toggle players have been demanding since 2020. It’s also gated behind a wall that most of the audience can’t climb.
The price of admission
To qualify, your machine has to be running Windows 11 with a specific security stack enabled: Secure Boot, TPM 2.0, virtualization-based security, hypervisor-protected code integrity, and memory integrity. In other words, the full Microsoft hardening checklist that ships disabled on a lot of OEM builds and that Windows 10 holdouts can’t satisfy at all. Riot’s framing is that an “on-demand” Vanguard is only safe to offer if the OS itself is doing the work Vanguard used to do at idle — verifying the boot chain, isolating the kernel, blocking unsigned drivers from loading behind its back.
That’s a defensible argument on the security merits. It’s also a quiet way of telling the loudest critics — the privacy-focused tinkerers, the dual-boot Linux crowd, the people running stripped-down Windows installs precisely because they don’t trust black-box services — that the compromise isn’t for them. The users most likely to want Vanguard off are the least likely to meet the criteria.
What it actually signals
The more interesting move is philosophical. Riot is effectively saying: if Microsoft’s platform-level defenses are turned on, we don’t need to be the always-on layer. That’s a tacit admission that Vanguard’s persistent residency was compensating for a weakly-defended host, not delivering some irreplaceable telemetry edge. It also pushes the responsibility down the stack. Future anti-cheats can point to this precedent — “meet the Windows 11 security baseline and we’ll behave” — which is good for power users with new hardware and bad for everyone running a five-year-old laptop.
Expect the rest of the kernel-level anti-cheat field, Easy Anti-Cheat and BattlEye in particular, to be asked why they can’t offer the same toggle. The honest answer is that they probably can; whether the publishers shipping them will is a different question. Riot just made the always-on default look like a choice rather than a necessity, and that’s the part competitors will have to answer for.