Riot Games Unveils Vanguard On-Demand Anti-Cheat Mode for Windows 11 PCs

Riot Games announced on June 24, 2026 that its kernel‑level anti‑cheat product, Vanguard, will now support on‑demand operation on PCs that meet a set of modern security requirements. The change, announced through a Riot news release and expanded in a Verge article, allows Vanguard to launch only when a Riot title is running, rather than starting automatically at system boot.

The new feature, called Vanguard Pre‑Check, is optional. According to Riot, players who wish to enable on‑demand mode will see a toggle appear in the next software update. If the toggle is left off, Vanguard will continue to run in the background as it has traditionally done.

Pre‑Check requires that a PC’s hardware and operating system satisfy several security features that are part of Windows 11 version 25H2. The list includes Secure Boot, a Trusted Platform Module (TPM) version 2.0, the Input‑Output Memory Management Unit (IOMMU), and Windows Virtualization‑Based Security (VBS) with Hypervisor‑Enforced Code Integrity (HVCI). Riot’s technical brief explains that these features collectively create a root of trust that prevents kernel‑level cheats from loading unsigned drivers or accessing game memory.

Secure Boot, a UEFI feature that verifies the bootloader’s signature, blocks bootkits that could otherwise bypass driver signing enforcement. TPM 2.0 stores cryptographic keys in a hardware‑isolated module; Riot notes that the TPM’s endorsement key can be used to identify devices that have been compromised. IOMMU restricts direct memory access (DMA) from peripheral devices, which is a common vector for wall‑hacking cheats. VBS and HVCI run a hypervisor that monitors kernel memory pages and rejects any that have been tampered with.

Riot’s announcement also references the Windows 11 25H2 update, which introduced the Runtime Driver Attestation Report. This feature allows anti‑cheat software to obtain a cryptographic hash of all drivers loaded since boot, even if the anti‑cheat was not running at the time. By comparing the hash against a blocklist of known vulnerable drivers, Vanguard can detect whether a compromised driver has been loaded without needing to run continuously.

The on‑demand mode is intended to reduce the system footprint for players who do not regularly play Riot titles. Vanguard’s driver component, which has historically launched at system start, will now remain dormant until a Riot game is launched. This change is expected to free up taskbar space and reduce background activity, while still providing the same level of protection when a game is active.

Riot’s anti‑cheat history dates back to April 2020, when Vanguard first appeared with Valorant. The anti‑cheat was later added to League of Legends in April 2024. Both games are played on Windows PCs, and Vanguard’s kernel‑level design has been a point of contention for privacy advocates. The new Pre‑Check feature is part of Riot’s effort to balance security with user experience.

According to the Riot support page, players who do not meet the Pre‑Check requirements can still use Vanguard in its default mode. The company notes that about 35% of players already satisfy the security prerequisites on newer hardware, while the remaining 65% will need to enable the listed features or upgrade their systems.

The Verge article highlights that the on‑demand option is “optional” and that players only need to take action if they want the reduced background presence. Riot’s spokesperson, Phillip Koskinas, emphasized that the feature does not affect gameplay or competitive integrity.

In summary, Vanguard’s on‑demand mode will be available to Windows 11 PCs that have Secure Boot, TPM 2.0, IOMMU, and VBS/HVCI enabled. Players can toggle the feature in the next update, and those who do not enable it will continue to run Vanguard in its traditional background mode.

The move reflects a broader industry trend toward hardware‑assisted security for online games, as developers seek to mitigate cheating while minimizing user disruption.