The question now is whether Vanguard Pre-Check can let Riot stop launching its anti-cheat at Windows startup without giving cheat makers a wider opening.
Starting today, eligible League of Legends and Valorant players can switch Riot Vanguard from an always-on setup to an on-demand mode, according to The Verge. The catch is significant: players need compatible hardware and must opt into “pre-boot security mechanisms and Windows’ own native protection features.”
Who can switch Vanguard to on-demand mode today?
Players who qualify for Vanguard Pre-Check will no longer have the Vanguard kernel-level driver launch automatically when Windows starts. Instead, Vanguard can launch when a protected Riot game does, then stop running after the player exits.
That’s the day-to-day change. Riot is not removing Vanguard from League of Legends or Valorant, and it’s not backing away from kernel-level anti-cheat. It’s changing when the driver needs to run for players whose machines can prove enough about their boot and driver state.
Phillip Koskinas, Riot’s head of anti-cheat, described Pre-Check as optional.
“you only need to do anything if you’d like to enable on-demand mode, which will allow Vanguard to launch when the game does and remain running only while you’re playing a Riot title,”
That distinction matters. If you don’t enable the new mode, or your PC doesn’t meet Riot’s requirements, the existing Vanguard behavior remains the practical path for playing Riot’s protected games.
Riot says 35 percent of players already meet the requirements and can switch to on-demand mode “with your very next update.” The remaining 65 percent will need to change system settings if they want Vanguard to stop launching at boot.
| Vanguard mode | When it runs | Who can use it |
|---|---|---|
| Current always-on behavior | Starts when Windows starts | Players using existing Vanguard setup |
| Vanguard Pre-Check on-demand mode | Starts with a Riot game and runs only while playing | Players with required hardware, Windows version, and security settings |
This is a narrow opt-in, not a universal toggle.
How did Microsoft’s kernel work make Vanguard Pre-Check possible?
Riot says the shift became possible after work with the Xbox OS Security Team at Microsoft on improvements to the Windows kernel. The goal of those changes is to block driver and memory exploit techniques used by cheat makers for wallhacks, aimbots, triggerbots, and similar tools.
The technical hinge is a Windows feature called the Runtime Driver Attestation Report. Riot uses it as a secured record of the device drivers loaded since boot, which gives Vanguard a way to assess whether suspicious drivers appeared before the game launched.
That solves the central problem with on-demand anti-cheat. If Vanguard isn’t running all the time, it still needs a trusted way to know what happened before it started.
Koskinas said Windows 11 25H2 is required partly because the driver attestation report was added there.
“mostly because the driver attestation report was only initially added in this version, but it’s also because, due to the natural progression of security, it gets more convenient to cheat the older your operating system is.”
Riot has been moving toward heavier use of Windows security features for some time. In a September 2024 Vanguard x VALORANT update, Riot said Vanguard had banned over 3.6 million accounts for cheating in Valorant over four years, “roughly one ban every 37 seconds,” and discussed security controls including TPM/Secure Boot, VBS, HVCI, and IOMMU.
That older Riot post also described the rise of Direct Memory Access (DMA) tools, which can connect to a motherboard and access program memory without going through the CPU. Riot said IOMMU helps block malicious devices from reaching game memory.
For readers tracking Windows security risks around drivers, developer tools, and consumer apps, XOOMAR’s related coverage of AutoJack turning an AutoGen Studio flaw into code execution risk and ClickFix malware targeting Windows PCs through Gizmodo abuse is useful context for why deep system trust keeps resurfacing as a flashpoint.
Which Windows settings decide whether Vanguard can stop launching at boot?
The requirements are strict. Riot says players who don’t already qualify need at least Windows 11 25H2, plus UEFI Mode, Secure Boot, and Trusted Platform Module 2.0 (TPM).
They also need Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI). Those features use Windows virtualization protections to harden parts of the system against unauthorized code.
The last listed requirement is Input-Output Memory Management Unit (IOMMU), the memory protection feature Riot has tied to defending against DMA-style cheating hardware.
Koskinas said most new machines already ship with these settings enabled.
“Most new machines today are already tested and shipped with these settings enabled by default, so this Vanguard update is only an optional incentive for those that wish to take advantage of it right now,” Koskinas says. “If that isn’t something you want to do, don’t sweat it.”
The practical read: Riot is asking Windows to carry more of the early trust burden. Vanguard still enforces Riot’s rules, but Windows has to prove the machine’s boot and driver history well enough for Riot to accept an on-demand launch.
That will make the setup experience matter. If the launcher clearly explains which requirement failed, Pre-Check looks like a useful upgrade. If players hit vague hardware or firmware blockers, the feature could feel like another BIOS scavenger hunt.
Will players trust a mode that still depends on deep system access?
Vanguard Pre-Check reduces one visible point of tension: the driver no longer has to start with Windows for eligible players. It does not remove the deeper bargain, because Vanguard still runs at kernel level when the game launches.
That’s the trade Riot is making. Strong anti-cheat remains tied to low-level system access, but the company is trying to limit when that access is active for players whose PCs meet newer Windows security standards.
The next test is operational, not theoretical.
Watch the first update cycle for three signals:
- Eligibility clarity: Whether Riot clearly shows why a player does or doesn’t qualify for Vanguard Pre-Check.
- Setup friction: Whether the 65 percent outside the ready group can change settings without confusion.
- Trust: Whether players accept on-demand Vanguard as a meaningful change, rather than a cosmetic one.
For now, the useful takeaway is simple: if your PC already meets Riot’s Windows security requirements, Vanguard can stop launching at startup. If it doesn’t, Riot is making the on-demand path available only after the machine can prove a tighter boot and driver chain.
Key Takeaways
- Eligible players can now avoid having Riot Vanguard run automatically at Windows startup.
- Riot is keeping kernel-level anti-cheat in League of Legends and Valorant, but changing when it runs for qualifying PCs.
- The rollout depends on hardware and Windows security settings, so most players may need changes before using on-demand mode.
Originally published on XOOMAR. For more news and analysis, visit XOOMAR.
