Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Riot Games is not trying to stop cheating with one detector or one ban wave. Its strategy is defense in depth: design games to expose less useful information, secure the Windows and hardware layers with Vanguard, analyze player behavior on its servers, punish accounts and repeat offenders, and pressure the businesses that sell cheats. The result is a higher cost of cheating and, according to Riot’s own measurements, fewer affected games—but not a world in which cheats are impossible.
“Hackers” usually means endpoint cheaters, not people breaking into Riot’s servers
In competitive games, the common problem is manipulation of the player’s own machine. A script automates actions such as aiming, spell casting or movement. A bot plays accounts without a person, often to farm currency, levels or accounts for sale. Kernel cheats run with Windows kernel privileges, where ordinary game software has less visibility. DMA cheats use external hardware to read or alter memory outside the normal CPU path. Bootkits load before Windows or before anti-cheat software. Pixelbots and input spoofers use computer vision or simulated controller and mouse signals instead of changing game files. Boosting and account manipulation can damage ranked play without conventional cheat software.
That distinction matters. Riot’s anti-cheat work is mainly about defending the game client, operating system, hardware boundary and competitive ecosystem—not claiming that every cheater has attacked Riot’s online infrastructure.
Why Vanguard needs kernel-level access
Riot says a user-mode anti-cheat can be inspected, disabled or deceived by a cheat running at a higher privilege level. Vanguard therefore combines three parts:
#1 Best Overall
- The next-generation optical HERO sensor delivers incredible performance and up to 10x the power efficiency over previous generations, with 400 IPS precision and up to 12,000 DPI sensitivity
- Ultra-fast LIGHTSPEED wireless technology gives you a lag-free gaming experience, delivering incredible responsiveness and reliability with 1 ms report rate for competition-level performance
- G305 wireless mouse boasts an incredible 250 hours of continuous gameplay on just 1 AA battery; switch to Endurance mode via Logitech G HUB software and extend battery life up to 9 months
- Wireless does not have to mean heavy, G305 lightweight mouse provides high maneuverability coming in at only 3.4 oz thanks to efficient lightweight mechanical design and ultra-efficient battery usage
- The durable, compact design with built-in nano receiver storage makes G305 not just a great portable desktop mouse, but also a great laptop travel companion, use with a gaming laptop and play anywhere
- Client: a user-mode component that performs detections while a Riot game is running.
- Driver: a kernel-mode component that validates memory and system state and helps prevent cheats from loading first.
- Platform: Riot’s backend services for detections, trust decisions and game access.
In Riot’s description, an untrusted PC cannot play VALORANT. Vanguard can be uninstalled, but a game that requires it will not launch without it. Riot has also said the driver does not collect or transmit computer information to Riot. That is a company assertion, not an independently demonstrated guarantee in the material available here.
Kernel access gives Vanguard a view that ordinary applications do not have, but it also increases the consequences of bugs, incompatible drivers or a compromise of the anti-cheat itself. Critics sometimes use terms such as “rootkit” or “spyware”; those are contested characterizations, not established facts. The technical point is simpler: Vanguard runs with unusually high Windows privileges, so players reasonably expect strong security, clear data practices and reliable appeals.
Riot’s defense-in-depth model
1. Expose less information in the first place
VALORANT uses systems including Fog of War and server-authoritative movement. Fog of War limits information sent to the client when it is not useful to the player, while server authority reduces what a modified client can decide for itself. Anti-cheat is stronger when the game does not hand an attacker unnecessary data.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute2. Watch the machine with Vanguard
Vanguard looks for tampering in the game, Windows and—where supported—early startup and hardware-security state. Riot’s rationale is that a defense confined to the game process loses a privilege race against kernel, boot or external-device cheats.
Rank #2
- HERO Gaming Sensor: Next generation HERO mouse sensor delivers precision tracking up to 25600 DPI with zero smoothing, filtering or acceleration
- 11 programmable buttons and dual mode hyper-fast scroll wheel: The Logitech wired gaming mouse gives you fully customizable control over your gameplay
- Adjustable weights: Match your playing style. Arrange up to five 3.6 g weights for a personalized weight and balance configuration
- LIGHTSYNC technology: Logitech G LIGHTSYNC technology provides fully customizable RGB lighting that can also synchronize with your gaming (requires Logitech Gaming Software)
- Mechanical Switch Button Tensioning: A metal spring tensioning system and metal pivot hinges are built into left and right computer gaming mouse buttons for a crisp, clean click feel with rapid click feedback
3. Analyze behavior and game telemetry
Riot combines player reports, performance and behavioral data, machine-learning research, suspicious game-state detection and manual review. A player who never modifies memory can still produce an impossible or highly distinctive pattern. Conversely, a single unusual match is not necessarily proof of cheating, which is why Riot describes multiple signals and human review rather than one magic score.
4. Make repeat cheating expensive
Enforcement can include account bans, manual bans, hardware-level actions, match termination, restrictions requiring stronger Windows security, ranked rollback and action against botting, boosting or players who deliberately queue with cheaters. Hardware actions are intended to stop a banned player from simply making another account, although shared computers, second-hand parts and internet cafés create difficult edge cases.
5. Attack the cheat economy
Riot’s stated target includes developers, distributors, bot farms, account sellers and hardware-cheat suppliers. Raising development costs, disrupting supply and removing replacement accounts can reduce the commercial value of cheating. Riot also describes legal avenues against cheat makers, although those cases are separate from a player-side detection result.
Why bans can be delayed
Immediate action is not always the most useful action. Riot says it may allow a suspicious account to continue temporarily so investigators can gather evidence, link related accounts or avoid revealing exactly which detection a cheat triggered. A public detection rule can teach cheat developers how to change their software.
Rank #3
- Next-gen 12,000 DPI HERO optical sensor delivers unrivaled gaming performance, accuracy and power efficiency
- Advanced LIGHTSPEED wireless gaming mouse for super-fast 1 ms response time and faster than wired performance
- Ultra-long battery life gives you up to 250 hours of continuous gaming on a single AA battery
- Lightweight mechanical design and classic shape for maximum maneuverability, durability and comfort
- Compact, portable design with convenient built-in storage for included USB wireless receiver
The trade-off is obvious: legitimate players may meet the cheater before enforcement and temporarily lose rating. Riot has discussed ranked rollback to restore losses from confirmed cheaters, but rollback cannot undo every frustrating match or guarantee that every affected game is identified.
What Riot reports for VALORANT
| Metric | What it means |
|---|---|
| More than 3.6 million cheating-account bans over four years | Riot-reported enforcement activity, including detection, manual and hardware actions. It is a count of accounts, not necessarily unique people, and excludes some botting, boosting and queueing-with-cheaters actions. |
| About one ban every 37 seconds during that period | A calculation based on the reported total; it does not measure the number of matches saved or the prevalence of cheating. |
Riot itself says the more meaningful questions are the percentage of games containing a cheater, time from activity to action, report volume, false positives and player sentiment. A large ban total can mean extensive enforcement, a large cheating population, repeat accounts, or improved detection—or several of these at once.
What Riot reports for League of Legends
| Riot-reported result | Qualification |
|---|---|
| More than 175,000 accounts banned for cheating since Vanguard’s League release | An account-enforcement figure, not an independently audited count of people. |
| Scripting below 1% of ranked games in the cited measurement | Riot’s definition, date and methodology should not be generalized beyond that report. |
| Botting fell from more than 1 million hours per day to fewer than 5,000 | Internal telemetry reported by Riot; the dossier provides no independent audit or confidence interval. |
| 3.5 million additional bot accounts removed | Riot’s reported post-rollout action against bot accounts. |
| 35,000 scripter bans in under 48 hours | A specific enforcement wave, not evidence that every cheat was detected immediately. |
Riot’s 2024 impact report says Vanguard reached League PC in spring 2024, with a Mac anti-cheat solution called Embedded VG. The company identifies scripting, botting and future action against boosting as continuing integrity concerns.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The new battlefield: firmware, DMA and Windows security
Some sophisticated cheats load before Vanguard or use a device that accesses memory externally. In a December 2025 security update, Riot described a pre-boot DMA protection gap involving motherboard firmware and IOMMU initialization. It worked with ASUS, Gigabyte, MSI, ASRock and CERT/CC on related advisories.
Rank #4
- ICONIC ERGONOMIC DESIGN WITH THUMB REST — PC gaming mouse favored by millions worldwide with a form factor that perfectly supports the hand while its buttons are optimally positioned for quick and easy access
- 11 PROGRAMMABLE BUTTONS — Assign macros and secondary functions across 11 programmable buttons to execute essential actions like push-to-talk, ping, and more
- HYPERSCROLL TILT WHEEL — Speed through content with a scroll wheel that free-spins until its stopped or switch to tactile mode for more precision and satisfying feedback that’s ideal for cycling through weapons or skills
- 11 RAZER CHROMA RGB LIGHTING ZONES — Customize each zone from over 16.8 million colors and countless lighting effects, all while it reacts dynamically with over 150 Chroma integrated games
- OPTICAL MOUSE SWITCHES GEN 2 — With zero unintended misclicks these switches provide crisp, responsive execution at a blistering 0.2ms actuation speed for up to 70 million clicks
A restriction can therefore mean that a machine resembles configurations used to bypass Vanguard—not that Riot has proved the owner cheated. Riot may ask players to update firmware or enable security features. BIOS menus differ by manufacturer; incorrect firmware changes can create boot problems, so players should follow their motherboard maker’s documentation rather than generic instructions.
Vanguard On-Demand changes the “always running” story
On June 24, 2026, Riot announced optional Vanguard On-Demand sessions for sufficiently secured PCs. Instead of loading the driver at every system startup, eligible systems can launch it when a Riot game starts and keep it active while the player is playing. This does not make Vanguard a universal requirement for every Windows configuration, nor does it remove the legacy behavior for systems that do not qualify.
Riot’s Vanguard Pre-Check baseline includes:
- Windows 11 version 25H2 or later
- UEFI and Secure Boot
- TPM 2.0
- Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI)
- IOMMU support
- Potentially a motherboard BIOS or firmware update
Riot estimated that approximately 35% of players already met the requirements at announcement time and about 3% lacked the necessary hardware entirely. Those are time-sensitive internal estimates, not a permanent industry-wide figure. Riot’s direction is a form of trust segmentation: use native Windows protections for eligible players, while applying stricter requirements to vulnerable systems, suspicious accounts or higher-risk competitive contexts.
Recommended Free Tools
PC and console cheating are different problems
Windows players control software, drivers and hardware in ways console players generally do not. On consoles, Riot says the threat is more focused on input manipulation, such as devices that imitate a mouse or controller. For VALORANT console, Riot has explored input-spoofer detection, match termination and player notifications.
Best Value
- Pentakill, 5 DPI Levels - Geared with 5 redefinable DPI levels (default as: 500/1000/2000/3000/4000), easy to switch between different game needs. Dedicated demand of DPI options between 500-8000 is also available to be processed by software.
- Any Button is Reassignable - 11 programmable buttons are all editable with customizable tactical keybinds in whatever game or work you are engaging. 1 rapid fire + 2 side macro buttons offer you a better gaming and working experience.
- Comfort Grip with Details - The skin-friendly frosted coating is the main comfort grip of the mouse surface, which offers you the most enjoyable fingerprint-free tactility. The left side equipped with rubber texture strengthened the friction and made the mouse easier to control.
- 5 Decent Backlit Modes - Turn the backlit on and make some kills in your gaming battlefield. The hyped dynamic RGB backlit vibe will never let you down when decorating your gaming space, it would be better with other Redragon accessories with lights on.
- Fatigue Killer with Ergonomic Design - Solid frame with a streamlined and general claw-grip design offers a satisfying and comfortable gaming experience with less fatigue even though after hours of use.
“Vanguard on console” should not be read as proof that the Windows kernel-driver architecture was simply transplanted to consoles. The platform attack surface and the appropriate countermeasures are different.
The privacy and compatibility bill
Riot says its anti-cheat, security and privacy teams coordinate on Vanguard, that it uses internal and external security review, and that its HackerOne program has paid nearly $2 million in security bounties at the time of its published statement. Those measures are positive signals, but they are not the same as a public, independent guarantee that every component is harmless or bug-free.
The costs are concrete:
- Kernel software has broader privileges and can conflict with legitimate drivers.
- A vulnerability in a privileged component could have consequences beyond one game.
- Secure Boot, VBS, HVCI, TPM and IOMMU can exclude older PCs or require intimidating firmware work.
- Hardware bans can create disputes on shared or previously owned machines.
- Riot withholds detection details to protect the system, limiting independent verification.
The reasonable question is not whether Vanguard is categorically “safe” or “spyware.” It is whether the reduction in cheating is worth the privileged software, hardware requirements and trust players are being asked to accept—and whether Riot provides enough transparency and recourse when the system is wrong.
Free tools Windows power users keep installed
One-click scans. No signup required.
Where the arms race still fails
- A cheat can load before the anti-cheat or exploit a vulnerable signed driver.
- A DMA device can attack memory outside the normal software path.
- Computer-vision tools and input spoofers can avoid conventional memory signatures.
- A sophisticated script can behave plausibly enough to evade simple statistical rules.
- A legitimate utility or driver can trigger a compatibility restriction.
- Cheat developers can change tactics after a detection update.
- An account ban may be followed by a replacement account or a newly botted account.
That is why Riot’s claim is about reducing frequency and impact, not achieving perfect prevention. Secrecy protects detections, but it also means outsiders cannot fully reproduce Riot’s measurements. Its published statistics should therefore be read as company-reported evidence, not independent certification.
Is Riot winning?
Riot’s League figures indicate substantial reductions in reported scripting and botting, while its VALORANT figures show extensive enforcement and increasing attention to hardware and pre-boot attacks. Those are meaningful results, but they do not prove that cheating has disappeared or declined uniformly in every region, rank or platform.
The fairest scorecard asks: How often does a player encounter a cheater? How quickly is action taken? How often are legitimate players blocked? How much system performance and compatibility are lost? Can repeat offenders be stopped without punishing shared machines? Are appeals and data practices trustworthy?
On that measure, Riot is fighting an arms race rather than delivering a final victory. Vanguard, server-side analytics, game design, delayed enforcement, hardware actions, Windows security and legal pressure make cheating harder to build, harder to hide and more expensive to repeat. They cannot make a competitive game running on player-controlled hardware cheat-proof.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
