The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Short answer: Vanguard was designed to load a kernel-mode driver when Windows started, but “always-on” is no longer universally accurate. Since June 2026, eligible PCs running Windows 11 version 25H2 can use Riot’s optional Vanguard On-Demand mode, which starts the driver when a Riot game launches rather than at boot. The driver still has kernel-level privileges while active, and the new mode requires TPM 2.0, UEFI Secure Boot, VBS/HVCI, IOMMU and, where necessary, current firmware.
What Vanguard is
Riot Vanguard is the anti-cheat system used by the PC version of VALORANT. Riot describes it as three connected parts:
- User-mode client: coordinates many detections while a Riot game is running.
- Kernel-mode driver: validates memory and system integrity at a much higher privilege level than an ordinary application.
- Online platform: receives detection information and applies restrictions, bans and related enforcement.
This separation matters. Calling Vanguard a single program that “spies on everything” obscures which component is active and what Riot says each component does. Riot’s architecture explanation is available at Riot’s security and privacy statement.
What “always-on” originally meant
In the original PC design, the kernel driver started with Windows. Riot’s reason was the “who loads first?” problem: a cheat with kernel access, or a vulnerable signed driver used by a cheat, could load before VALORANT and Vanguard, alter system or game memory, then hide or unload before detection began.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- TRIFORCE TITANIUM 50 MM DRIVERS — Our cutting-edge proprietary design divides the driver into 3 parts for the individual tuning of highs, mids, and lows—producing brighter, clearer audio with richer highs and more powerful lows
- HYPERCLEAR CARDIOID MIC — An improved pickup pattern ensures more voice and less noise as it tapers off towards the mic’s back and sides, with the sweet spot easily placed at the mouth because of the mic’s bendable design
- ADVANCED PASSIVE NOISE CANCELLATION — Sturdy closed earcups fully cover the ears to prevent noise from leaking into the headset, with its cushions providing a closer seal for more sound isolation
- LIGHTWEIGHT DESIGN WITH MEMORY FOAM EAR CUSHIONS — At just 240 g, the headset features thicker headband padding and memory foam ear cushions with leatherette to keep gaming in peak form during grueling tournaments and training sessions
- WORKS WITH WINDOWS SONIC — Make the most of the headset’s powerful drivers by pairing it with lifelike surround sound that places audio with pinpoint accuracy, heightening in-game awareness and immersion
That boot-start behavior did not mean the same kind of gameplay scanning was continuously taking place while VALORANT was closed. Riot said the user-mode client handled game-running detections, while the driver established trust in the machine and checked memory and system state. Riot also stated that the driver did not collect or send computer information in that published 2020 description. That is a first-party account of the implementation at the time, not an independent audit or a guarantee that every future version is identical.
Why kernel-level access is controversial
User-mode software is constrained by Windows security boundaries. Kernel-mode code operates with far broader access to memory, drivers and core operating-system functions. That visibility helps an anti-cheat confront threats that stay below the game process, including kernel cheats, bring-your-own-vulnerable-driver (BYOVD) attacks, bootkits and some direct-memory-access (DMA) techniques.
The trade-off is equally direct: a defect, incompatibility or compromise in a kernel driver can have consequences well beyond a normal application crash. Vanguard is a signed kernel anti-cheat driver; describing it as a rootkit or malware as an established fact would be inaccurate, but the privilege level explains why critics make that comparison and why the security decision deserves scrutiny.
What Vanguard is designed to detect
- Game-process and memory tampering.
- Kernel-level cheats and vulnerable-driver abuse.
- Boot-time or pre-OS manipulation.
- DMA devices that attempt to access system memory.
- Computer-vision and pixelbot systems.
- Behavioral and server-side anomalies.
Riot reported that traditional internal cheats represented less than approximately 10% of infected matches in its June 2026 explanation, and that about 0.7% of PC ranked matches across League of Legends and VALORANT were infected at publication. Those are Riot’s measurements, not independently audited industry statistics. Riot also reported more than 3.6 million VALORANT cheating-account bans over Vanguard’s first four years—roughly one ban every 37 seconds—on its own terms at the Vanguard performance page. Enforcement totals demonstrate activity, not perfect detection or the number of undetected cheaters.
Rank #2
- 【Amazing Stable Connection-Quick Access to Games】Real-time gaming audio with our 2.4GHz USB & Type-C ultra-low latency wireless connection. With less than 30ms delay, you can enjoy smoother operation and stay ahead of the competition, so you can enjoy an immersive lag-free wireless gaming experience.
- 【Game Communication-Better Bass and Accuracy】The 50mm driver plus 2.4G lossless wireless transports you to the gaming world, letting you hear every critical step, reload, or vocal in Fortnite, Call of Duty, The Legend of Zelda and RPG, so you will never miss a step or shot during game playing. You will completely in awe with the range, precision, and audio quality your ears were experiencing.
- 【Flexible and Convenient Design-Effortless in Game】Ideal intuitive button layout on the headphones for user. Multi-functional button controls let you instantly crank or lower volume and mute, quickly answer phone calls, cut songs, turn on lights, etc. Ease of use and customization, are all done with passion and priority for the user.
- 【Less plug, More Play-Dual Input From 2.4GHz & Bluetooth】 Wireless gaming headset adopts high performance dual mode design. With a 2.4GHz USB dongle, which is super sturdy, lag＜30ms, perfectly made for gamers. Bluetooth mode only work for phone, laptop and switch. And 3.5mm wired mode (Only support music and call).
- 【Wide Compatibility with Gaming Devices】Setup the perfect entertainment system by plugging in 2.4G USB. The convenience of dual USB work seamlessly with your PS5,PS4, PC, Mac, Laptop, Switch and saves you from swapping cables.
The 2026 change: Vanguard On-Demand
Riot’s Vanguard On-Demand model uses Windows 11 version 25H2’s Runtime Driver Attestation. In Riot’s description, Windows records driver activity after boot in a TPM-backed, append-only measurement chain. When a Riot game launches, Vanguard can inspect that attestation even though its own driver was not active during the earlier part of the session.
On qualifying machines, the practical result is that Vanguard no longer has to start at the instant Windows starts. This changes when the kernel driver loads, not its privilege level or Riot’s need to trust the software while it is running. On-Demand is optional and is not a universal replacement for the conventional startup arrangement.
Who can use Pre-Check and On-Demand?
Riot’s documented baseline is:
- Windows 11 version 25H2 or later.
- UEFI firmware mode.
- TPM 2.0 enabled.
- Secure Boot enabled.
- Virtualization-based security (VBS) and HVCI/Memory Integrity enabled.
- IOMMU enabled.
- A current motherboard BIOS/UEFI where required.
Pre-Check is optional. Systems that do not meet it can continue using the conventional Vanguard model, subject to Riot’s current compatibility and security requirements. Windows 10 does not receive the documented Pre-Check option.
How to check the important settings
TPM 2.0
- Press Windows + R.
- Enter
tpm.msc. - Confirm that a TPM is present and ready for use.
You can also open Windows Security → Device security → Security processor details. Riot’s TPM guide is at this support page.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- Immersive 7.1 Surround Sound: This gaming headset delivering stereo surround sound for realistic audio. Whether you're in a high-speed FPS battle or losing yourself RPG adventures, this Ps5 headset provides crisp treble, punchy bass, and precise directional cues, giving you a competitive edge
- Great Humanized Design: Comfortable and breathable permeability protein over-ear pads perfectly on your head, adjustable headband distributes pressure evenly, you’ll enjoy lasting comfort during hours of gaming and suitable for all gaming players of all ages
- Sensitivity Noise-Cancelling Microphone: 360° omnidirectionally rotatable sensitive microphone, premium noise cancellation, sound localisation, your voice comes through loud and natural, ensuring your teammates catch every callout, even in chaotic battle scenes.
- Universal Compatibility: This gaming headphone support for PC, Ps5, Ps4, Xbox one, Xbox Series X/S, Switch, Laptop, Mobile Phone and other devices with 3.5mm jack.Note 1: When you use headset on your PC, be sure to connect the "1-to-2 3.5mm audio jack splitter cable" (Red-Mic, Green-audio). (Please note you need an extra Microsoft Adapter when connect with an old version Xbox One controller)
- Cool style gaming experience: Colorful RGB lights create a gorgeous gaming atmosphere, adding excitement to every match. Heightening immersion for FPS, MOBA, and action titles. These eye-catching lights give your setup a gamer-ready look while maintaining focus on performance. (*Note: The USB connector is for LED lighting only)
UEFI and Secure Boot
- Press Windows + R and enter
msinfo32. - Check BIOS Mode; it should read
UEFI. - Check Secure Boot State; it should read
On.
Riot’s Secure Boot guidance is available at this support page.
HVCI / Memory Integrity
- Open Windows Security.
- Select Device security.
- Open Core isolation details.
- Enable Memory integrity and restart.
If Windows refuses to enable it, an incompatible driver or disabled firmware virtualization may be the cause. Updating or removing the offending software is safer than disabling security features wholesale.
IOMMU and firmware
IOMMU labels vary. AMD firmware may use “IOMMU,” “DMA Protection” or “DMAr Support.” Intel systems may show “VT-d” or a similar System Agent option. ASUS, MSI and other vendors place these controls differently, so use the motherboard maker’s documentation and Riot’s support guidance at the Vanguard restrictions page.
If Windows was installed in Legacy BIOS mode on an MBR disk, switching directly to UEFI or Secure Boot can make it unbootable. Verify the disk’s partition style, back up important data and follow hardware-specific instructions before changing firmware settings; there is no safe universal conversion sequence.
Rank #4
- Enjoy expansive cinematic sound. Big 50 mm audio drivers deliver an incredible sound experience
- Hear Enemies From All Sides. DTS Headphone:X 2.0 surround sound(1) lets you hear enemies sneaking behind you, special ability cues, and immersive environments. It’s positional clarity that can make the difference between victory and defeat. Experience three-dimensional audio that goes beyond 7.1 channels to make you feel like you’re right in the middle of the action. (1) DTS Headphone:X 2.0 requires Logitech G HUB Software.
- Be Heard Loud and Clear. The big 6 mm boom mic makes sure you’re heard by gaming partners and mutes when flipped up.
- Use One Headset For Most Game Platforms. Your headphones work with your PC or Mac via USB DAC or 3.5 mm cable, mobile devices with 3.5 mm cable or with gaming consoles including PlayStationⓇ 5 and PlayStationⓇ 4 (USB wireless stereo sound only), Nintendo Switch (wireless stereo sound when docked)
- Game for Hours in Comfort. Everything about these headphones is about comfort: The deluxe lightweight leatherette ear cups and headband are made to keep pressure off your ears. Ear cups rotate up to 90 degrees for convenience.
Restrictions, bans and compatibility errors are different
A VAN:Restriction message does not by itself prove cheating. Riot says restrictions can result when a system resembles environments used to evade Vanguard—for example, disabled security features, vulnerable firmware or suspicious hardware—and may apply at account or hardware-identifier level. A restriction is a trust or configuration decision; a ban is punitive enforcement; a compatibility error means Vanguard or Windows cannot operate correctly.
Riot’s motherboard security update addressed pre-boot DMA weaknesses and blocked certain cheating hardware. That is different from claiming that Vanguard physically damages ordinary PCs. A crash, boot failure, firmware defect, incompatible driver and a VAN restriction require different diagnoses. See Riot’s explanation at the motherboard security update page.
Privacy and security: what can—and cannot—be concluded
The meaningful questions are component-specific: what the driver, client and backend collect; what is retained; what is transmitted while the game is closed; which third-party drivers are inspected; and how vulnerabilities are handled.
Riot says the driver itself does not collect or send computer information and that Vanguard does not collect more personal information than its anti-cheat needs. Riot also points to internal and external reviews and a vulnerability-bounty program. Those measures reduce risk but do not make a kernel driver risk-free, and public descriptions do not independently verify every implementation detail.
Recommended Free Tools
Best Value
- ADVANCED PASSIVE NOISE CANCELLATION — sturdy closed earcups fully cover ears to prevent noise from leaking into the headset, with its cushions providing a closer seal for more sound isolation.
- 7.1 SURROUND SOUND FOR POSITIONAL AUDIO — Outfitted with custom-tuned 50 mm drivers, capable of software-enabled surround sound. *Only available on Windows 10 64-bit
- TRIFORCE TITANIUM 50MM HIGH-END SOUND DRIVERS — With titanium-coated diaphragms for added clarity, our new, cutting-edge proprietary design divides the driver into 3 parts for the individual tuning of highs, mids, and lowsproducing brighter, clearer audio with richer highs and more powerful lows
- LIGHTWEIGHT DESIGN WITH BREATHABLE FOAM EAR CUSHIONS — At just 240g, the BlackShark V2X is engineered from the ground up for maximum comfort
- RAZER HYPERCLEAR CARDIOID MIC — Improved pickup pattern ensures more voice and less noise as it tapers off towards the mic’s back and sides
Two extreme claims are therefore unsupported: “Vanguard is spyware” and “there is absolutely no privacy or security risk.” The defensible position is that Vanguard’s elevated privilege provides stronger visibility against sophisticated cheats while creating a larger potential blast radius than user-mode software.
Uninstalling or reinstalling Vanguard
Riot says Vanguard can be removed through Windows’ installed-apps interface, but VALORANT will not run without it. If you need a clean reinstall:
- Close Riot Client and VALORANT.
- Uninstall Riot Vanguard through Windows installed apps.
- Restart if Windows or Riot requests it.
- Launch Riot Client or VALORANT to reinstall Vanguard.
- Restart again if prompted.
- For a continuing VAN error, follow Riot’s current support article for that exact code rather than manually deleting or renaming driver files.
Is Vanguard reasonable for you?
Accepting Vanguard is most understandable if VALORANT’s competitive integrity is a priority and you accept a trusted, privileged driver. On-Demand makes the compromise less intrusive for supported Windows 11 25H2 systems. Hesitation is reasonable if you avoid kernel-level third-party software, use older hardware, depend on specialist drivers or PCIe devices, or cannot safely meet the required firmware and Windows security baseline.
Riot’s original always-starting rationale was technically coherent: a driver that arrives after a kernel cheat can be too late. The 2026 design reduces background presence without eliminating kernel access or the need to trust Riot. The right choice depends on whether playing VALORANT outweighs that trust and configuration cost.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
