Image: "Headset computer" by Wikideas1 (CC0)
No, Valorant is not malware. Malware is software built to harm you or act without your consent. Valorant and its anti-cheat, Riot Vanguard, are disclosed up front, installed with your permission and can be removed whenever you like. The worry is real, though. Vanguard runs at kernel level, the most privileged layer of Windows, and it has usually started when your PC boots, not when you open the game. That level of access is why some players call it spyware or malware. Below is what Vanguard actually does, how it compares with anti-cheat in other games, and how to decide whether you're comfortable installing it.
What Vanguard is and why it runs so deep
Vanguard is Riot Games' own anti-cheat. It arrived with Valorant in 2020 and was added to League of Legends in April 2024, according to Wikipedia's Riot Vanguard page. On Windows it has two parts: a kernel-mode driver and a client that runs while you play.
Riot's reasoning is simple. Many serious cheats now run as kernel drivers themselves. An anti-cheat that runs as a normal program sits at a lower privilege level than those cheats, so it can be fooled or blinded. Riot's answer was to put its anti-cheat in the kernel too, and to load it early in the boot process, before a cheat driver gets the chance.
That is also why Vanguard has traditionally needed a restart. Riot's support page says Vanguard is usually an on-boot application. If you disable it and later want to play, you have to reboot.
Why kernel access worries players
The concern isn't that Riot is secretly stealing your files. It's about risk and trust. Here are the main points critics raise:
- A bigger attack surface. Code running in the kernel has full access to the system. If that code has a bug, an attacker who finds it gets the same deep access. Critics have pointed out that giving an anti-cheat higher privileges could open a door for attackers.
- It used to run all the time. A boot-time driver stays loaded even when you aren't playing. Many people don't like a game component sitting on their PC around the clock.
- You can't see inside it. Riot hasn't publicly documented how Vanguard works internally. Plenty of guides online claim to know exactly what the driver scans, but as LaptopJudge notes, those details aren't verified and should be treated with caution.
- Trust in the company. Installing kernel software means trusting the publisher completely. Some players simply don't extend that trust to any game company, including Riot.
The risk isn't just theory. In 2022, security researchers reported that ransomware attackers abused a legitimate anti-cheat driver from another game, Genshin Impact, to switch off security software. Nobody had to play that game for the attack to work. The driver just had to be signed and trusted by Windows. That case is often cited when people argue against kernel anti-cheat in general.
What Riot says in its defence
Riot argues that kernel-level scanning is the only effective way to catch modern cheats. Over the years it has pointed to bug bounties and public write-ups, and it lets you turn Vanguard off without uninstalling the game. You just can't play Riot games while it's off.
Vanguard also has to work within Windows' own protections, such as PatchGuard (Kernel Patch Protection), which detects certain unauthorised kernel changes. It isn't a free pass to rewrite your operating system.
The biggest change came in 2026. Vanguard On-Demand, released on June 24, 2026, lets Vanguard run only while a Riot game is open and close afterwards. It only works if your PC meets a set of security requirements, including Windows 11 version 25H2 or newer. Riot's anti-cheat chief, Phillip Koskinas, said this wasn't possible at launch because Windows and PC hardware didn't yet have the security features to support it. Riot's support page calls the check Vanguard Pre-Check.
If the always-on part was your main objection, On-Demand addresses most of it, as long as your hardware and Windows version qualify.
How Vanguard compares with other games
Vanguard isn't unique in using the kernel. It stands out in a few specific ways.
- Easy Anti-Cheat and BattlEye are licensed to many different studios and protect a long list of games. Both use kernel-level components. They generally start with the game rather than at boot, which is the main reason they draw less criticism.
- Vanguard only protects Riot titles, including Valorant, League of Legends, Teamfight Tactics and 2XKO. Because Riot controls the whole stack, it can push aggressive changes without worrying about other publishers' games.
- Boot-time loading was Vanguard's defining and most controversial trait. With On-Demand, eligible PCs now behave more like other anti-cheat systems.
- Hardware rules. Vanguard is tied to Windows security features like TPM 2.0 and Secure Boot, which can block older or oddly configured PCs from playing.
- Consoles are different. The console version of Valorant, released in June 2024, uses anti-cheat under the Vanguard name, but it works very differently from the Windows kernel driver.
So the honest comparison is this. If you already play games with Easy Anti-Cheat or BattlEye, you've already got kernel-level anti-cheat on your PC. Vanguard goes further mainly in how early it loads and how strict it is about hardware security.
The "$6,000 paperweight" scare
On May 19, 2026, Riot updated Vanguard to turn on IOMMU memory protection for accounts flagged for using DMA cheats. DMA cards are hardware devices that read or change a game's memory directly, and IOMMU stops that from working.
Riot then posted on X congratulating cheaters on their "brand new $6,000 paperweight." The joke made some players think Vanguard could physically damage hardware. Riot denied it, saying it "would not and cannot" use Vanguard to brick PCs. The devices stopped working for cheating. They weren't destroyed.
If you buy used PC parts or accounts
This part matters if you trade on marketplaces. Riot issues hardware bans, so a ban can stick to the machine and not just the account. Reports from October 2026 suggest that secondhand hardware once used by a cheater in a Vanguard game may be affected. The details we found are incomplete, so treat this as unsettled and check Riot's official channels before buying a used gaming PC or parts with Valorant in mind.
Buying or selling Valorant accounts also breaks Riot's terms of service. A flagged account can carry extra restrictions, such as the forced IOMMU setting. If you want to spend on Valorant safely, buy Valorant Points through official channels or from a trusted seller of legitimate gift cards.
How to decide, step by step
- Check your system. Open Windows settings and confirm your Windows version. If you're on Windows 11 25H2 or newer with TPM 2.0 and Secure Boot enabled, see whether Vanguard Pre-Check lets you run On-Demand.
- Weigh what's on the PC. On a machine you also use for banking or work, you may prefer to keep any kernel software to a minimum. A gaming-only PC lowers the stakes.
- Look at what you already run. If you already play games with kernel-level anti-cheat, Vanguard adds less new risk than you might think.
- Keep things updated. Install Windows updates and keep Vanguard current, since fixes for security bugs arrive through updates.
- Know how to switch it off. You can exit Vanguard from its system tray icon, or uninstall Riot Vanguard from Windows' installed apps list. Valorant needs it again before you can play.
When Vanguard causes problems
- Game won't launch after disabling Vanguard: restart your PC. Without On-Demand, Vanguard has to load at boot.
- Errors about TPM or Secure Boot: these settings live in your PC's firmware. Follow your motherboard maker's official instructions and don't change firmware settings you don't understand.
- Low frame rates: Vanguard isn't usually a major cause of FPS loss. Check drivers, cooling and background apps first.
- Don't hack around it. Deleting Vanguard files, editing boot records or using Safe Mode to dodge it can cause startup failures or launch blocks. Bypassing it also breaks Riot's terms and risks a permanent hardware ban.
FAQ
Does Vanguard spy on my files? There's no verified evidence of that. Riot hasn't published the full internals, so outsiders can't fully confirm what it checks. The real concern is the level of access, not proven misuse.
Can I uninstall Vanguard and keep Valorant? Yes, but you can't play until you reinstall it.
Does Vanguard still run when I'm not playing? Usually yes, unless your PC qualifies for Vanguard On-Demand.
Can Vanguard damage my hardware? Riot says it would not and cannot brick PCs. The DMA update disabled cheat devices from working, not the PC itself.
Is Vanguard worse than other anti-cheat? It's stricter and historically loaded earlier, but kernel access itself is common across competitive PC games.