Riot Games have begun rolling out an on-demand mode for Vanguard, the kernel-level anti-cheat behind Valorant and League of Legends, letting the driver launch only when a Riot game opens instead of loading at system start. The change went live on 24 June 2026 and is built around a set of hardware security requirements Riot calls Vanguard Pre-Check. It is entirely optional, and players who do nothing will keep running Vanguard exactly as before.
Starting later today, Vanguard will be able to run in on-demand mode for players on Windows 11.
You just need to enable some optional security features for your motherboard, and your taskbar can have 256 of its pixels back. Take it away, @deteccphilippe. pic.twitter.com/hBytOMKTjm
— Riot Games (@riotgames) June 24, 2026
The always-on driver, which loads at boot and sits in the system tray around the clock, has been the central complaint against Vanguard since the anti-cheat arrived alongside Valorant in 2020 and expanded to League of Legends in 2024. On-demand mode is Riot’s answer to that, made possible by kernel hardening work the company carried out with Microsoft.
What Vanguard On-Demand Mode Actually Changes
With Pre-Check satisfied, Vanguard’s driver component no longer launches when Windows starts. It loads when you open a Riot title and shuts down once you stop playing, rather than maintaining its constant presence from boot. Riot’s head of anti-cheat, Phillip “mirageofpenguins” Koskinas, framed the practical upshot as the taskbar reclaiming 256 pixels, with the system-tray icon gone unless a Riot game is actively running.
It is worth being precise about what has not changed. Vanguard is still kernel-level anti-cheat. On-demand mode changes when the driver runs, not whether it operates at the kernel, and it does not extend support to Mac or Linux, both of which remain unsupported. The shift brings Vanguard closer to how other kernel anti-cheats behave by tying its runtime to the game session rather than the boot sequence.
Why On-Demand Is Only Possible Now
The reason Vanguard previously had to start at boot comes down to what Riot calls the “who loads first” problem. A vulnerable driver could load before the game did, map a cheat into the kernel, then unload itself, hiding from any anti-cheat that started later. Running from system start was Vanguard’s way of maintaining an unbroken trust chain and confirming the kernel had not been compromised before the game launched.
What removes that requirement is work Riot did with Microsoft’s Xbox OS Security Team on the Windows kernel. Newer builds add a Runtime Driver Attestation Report, which lets an anti-cheat retrieve a secured list of every driver loaded since boot through the system’s TPM, even if the anti-cheat was not running to witness it. That cumulative record can only be extended, not altered, so tampering breaks the chain of trust and corrupts the data. It closes the “who loads first” gap without Vanguard needing to be present from the start.
Vanguard Pre-Check Hardware Requirements
Pre-Check is the set of modern security features a system must have enabled for on-demand mode to be available. The minimum is Windows 11 25H2, which Koskinas notes is partly because the driver attestation report was first added in that version, and partly because cheating gets easier the older an operating system is. The required settings are below.
| Requirement | What It Does |
|---|---|
| Windows 11 25H2 or later | Minimum OS version, required for the Runtime Driver Attestation Report |
| UEFI Mode and Secure Boot | Verifies the Windows bootloader and blocks bootkits during load |
| Trusted Platform Module 2.0 (TPM) | On-board cryptoprocessor that stores keys and backs driver attestation |
| Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI) | Isolates secure memory and verifies kernel code before it executes |
| Input-Output Memory Management Unit (IOMMU) | Acts as a firewall between PCIe devices and system memory, blocking direct memory access abuse |
An updated BIOS may be necessary, and most of these are UEFI settings Vanguard cannot change itself, so they have to be enabled manually. Riot warns against making BIOS changes without first consulting your motherboard manufacturer’s documentation, since menus and labels vary widely between vendors.
Who Already Qualifies for Pre-Check
Most new machines ship with these settings enabled by default. Koskinas puts the share of players who already satisfy the Pre-Check requirements at 35 percent, with those players getting the button to switch into on-demand mode with their next update. A separate figure cited by Riot puts the fully secured group at around 34 percent, growing by roughly 1 to 2 percent per month.
The remaining 65 percent will need to make changes, most by enabling the required settings in BIOS. Around 3 percent of weekly players are on devices that lack one or more of the necessary hardware features entirely and would need a hardware upgrade to qualify. Riot has said it is not requiring anyone to change anything and is willing to wait for the wider ecosystem to mature.
How Big the Cheating Problem Still Is
Riot reports that cheaters turn up in roughly 0.7 percent of all PC ranked matches across League of Legends and Valorant. Kernel-level cheating remains the most common method, since both Direct Memory Access cheats and computer-vision pixelbots typically require extra hardware, leaving kernel exploits as the cheapest route. Koskinas also pointed to AI lowering the barrier to producing new cheats, with more individual cheat assets appearing than before, many unique to a single user.
Riot’s stated approach is to focus on detecting how cheats get their code into the kernel rather than chasing each individual cheat, which is the same principle the attestation-backed on-demand model relies on.
What Pre-Check Points Toward
Koskinas described Pre-Check as proactive, voluntary trust segmentation for genuine hardware and real players, and signalled Riot may add further checks over time while keeping the system optional except in the most competitive segments, on unusual devices, or at the highest ranks. The framing positions Pre-Check as a proof-of-life layer for competitive play as AI continues to lower the cost of botting. For now, the next thing to watch is how many players move into the fully secured bucket, with Riot already naming pixelbots as the focus once on-demand adoption grows.