Until June 2026, Riot Games’ anti-cheat software started running the moment you turned your computer on, whether or not you had any plans to play League of Legends or Valorant that day. That’s not a design accident; it’s how the most aggressive form of anti-cheat systems has worked for years, running with the same deep operating-system access as your antivirus software so it can catch cheats that operate at that same level. Two very different philosophies now compete to solve the same problem, and the gap between them explains a lot about why cheating in online games is such a stubborn fight.
Two Very Different Ways to Catch a Cheater
Broadly, competitive multiplayer games rely on one of two approaches, or some blend of the two. The first is kernel-level anti-cheat: a driver that loads into Ring 0, the operating system’s most privileged layer, giving it visibility into system calls, memory, and other processes that ordinary software can’t see. Riot’s Vanguard and Epic’s Easy Anti-Cheat both work this way. The second is server-side and behavioral detection, where the game server and supporting systems analyze how you actually play, aim movement, reaction times, hit patterns, for statistical signs of cheating rather than inspecting your PC directly. Valve’s system for Counter-Strike 2 leans heavily on this second approach.
What Kernel-Level Access Buys You
Cheat software that manipulates a game’s memory or intercepts its inputs can, in principle, run with the same privilege level as the operating system itself, which is exactly why some anti-cheat vendors decided their detection software needed that same level of access to compete. From Ring 0, an anti-cheat driver can spot a cheat tool hiding in ways a normal application-level scanner never would. The tradeoff is trust: a kernel driver that’s compromised, buggy, or exploited doesn’t just break a game, it can crash or expose the entire system, the same category of risk that caused the widespread 2024 CrowdStrike IT outages when a flawed kernel-level security update took down machines worldwide. That single, unrelated incident did more than anything else to make gamers and security researchers alike scrutinize what kernel-level anti-cheat software is actually doing on their PCs.
Riot Made Vanguard Less Invasive, Not Less Capable
Riot’s answer, announced in its own June 2026 Vanguard On-Demand update, is to keep the kernel driver but stop running it around the clock. Under the new on-demand mode, Vanguard’s driver now loads only when a Riot game launches and unloads when you close it, instead of starting automatically at boot and running in the background at all times. Riot credits newer Windows security features, including Microsoft’s Runtime Driver Attestation and baseline protections like TPM 2.0 and Secure Boot, for making this possible without weakening detection. It’s opt-in: players who prefer the always-on setup can keep it, and roughly a third of players qualified for on-demand mode immediately, with the rest able to enable it by adjusting BIOS settings.
The Other Path: Machine Learning Instead of Kernel Access
Valve has taken a different route with VACnet, its machine-learning system for Counter-Strike 2, which runs without the kind of kernel-level driver Vanguard uses. VACnet analyzes server-side behavioral data, aim-trajectory patterns, tracking consistency, reaction-time distributions, and flags matches that look statistically like cheating, learning from a large set of human-reviewed examples rather than inspecting a player’s PC directly. When CS2 moved to the Source 2 engine, the game’s underlying physics and networking changed enough that VACnet’s older training data stopped mapping cleanly onto the new game, a known limitation of any learning system trained on one version of a product. Valve’s response was a labeling portal, launched in August 2026, where trusted players review flagged clips and categorize them by cheat type, generating fresh, CS2-specific training data rather than triggering bans directly.
Why This Is Still a Cat-and-Mouse Game
Neither approach fully solves cheating on its own. Kernel-level anti-cheat can catch cheats that hide from ordinary detection, but cheat developers who find a kernel-level exploit gain the same dangerous level of system access the anti-cheat itself relies on, which is the core of most security researchers’ objections to the category. Behavioral and machine-learning detection avoids installing anything invasive on your PC, but a genuinely skilled human player can produce statistics that look similar to a well-tuned cheat, and a well-designed cheat can be tuned to avoid statistically obvious patterns. Most competitive multiplayer games that take cheating seriously, including the ones behind cross-platform matchmaking, end up combining both approaches rather than picking one side of this tradeoff outright. It’s also part of why cloud gaming services are an interesting side case: when the game itself runs on a remote server you don’t control, a whole category of client-side memory-manipulation cheats becomes far harder to pull off in the first place.
What This Means If You Play Competitive Games
If a game you play requires a kernel-level anti-cheat driver, it’s worth knowing what that means in practical terms: the software runs with elevated system privileges any time it’s active, so keeping your operating system, drivers, and the anti-cheat software itself fully updated matters more than it does for an ordinary application. If a game offers an on-demand or opt-out mode the way Vanguard now does, there’s little downside to using it if your hardware qualifies, since it reduces how much of the time that elevated software is actually running. And if a match feels off, unnaturally perfect aim, impossible reaction times, most current systems, kernel-based or behavioral, do eventually catch sustained cheating, even when it takes longer than players would like.
FAQs
Is kernel-level anti-cheat software safe to have installed?
For the vast majority of players, yes, major publishers like Riot and Epic maintain these drivers carefully and they don’t cause problems in normal use. The legitimate concern is systemic: any software running with that level of privilege becomes a bigger target and a bigger risk if something in it breaks, which is why the 2024 CrowdStrike incident got so much attention even though it wasn’t a gaming anti-cheat at all.
Does Vanguard’s on-demand mode make Valorant or League of Legends less protected against cheaters?
No. Riot’s own announcement frames on-demand mode as reducing how long the driver runs, not reducing what it can detect while a match is active. The driver still loads with full functionality whenever you launch a supported game.
Why doesn’t every competitive game use kernel-level anti-cheat?
It’s a real tradeoff between detection power and the privacy and stability concerns that come with granting a driver deep system access. Some studios, like Valve with Counter-Strike 2’s VACnet, have chosen to invest in server-side and behavioral detection instead, avoiding the kernel-level footprint entirely.
Can anti-cheat software ban you by mistake?
It happens, though reputable systems build in review steps specifically to reduce it. Valve’s newer VACnet labeling portal, for example, routes flagged clips through human review to generate training data rather than issuing instant automated bans, which is partly a response to exactly this concern.
Why do cheaters keep finding ways around anti-cheat systems?
Anti-cheat detection and cheat development are a continuous arms race, not a problem that gets permanently solved. Every new detection method eventually gets studied and worked around by cheat developers, which is why publishers keep retraining machine-learning systems and patching kernel-level drivers rather than treating either as a finished product.
Discussion about this post