What Is Vanguard On-Demand?

Traditionally, Vanguard's kernel driver launched every time Windows booted, allowing it to establish trust before any potential cheat software could load. With the upcoming update, systems that meet Riot's new security requirements can instead choose to start Vanguard only when launching VALORANT or other Riot games.

Riot states this is entirely optional. Players who prefer the existing behavior can continue using Vanguard exactly as before, while eligible systems gain the option of running the anti-cheat only during gameplay.

Introducing Vanguard Pre-Check

The new system is built around Vanguard Pre-Check, a security verification process that determines whether a PC satisfies Riot's recommended hardware and operating system protections.

To enable On-Demand mode, Riot recommends:

• Windows 11 version 25H2 or newer
• UEFI mode with Secure Boot enabled
• Trusted Platform Module (TPM 2.0)
• Virtualization-Based Security (VBS)
• Hypervisor-Protected Code Integrity (HVCI)
• Input-Output Memory Management Unit (IOMMU)

These protections allow Windows to verify the integrity of the operating system before the game launches, reducing the need for Vanguard to monitor the system continuously.

More Focus on Hardware Security

Riot's latest strategy shifts more responsibility to built-in hardware security rather than relying solely on Vanguard's kernel driver. By leveraging technologies such as TPM, Secure Boot, HVCI, and IOMMU, Riot aims to make sophisticated cheating techniques significantly more difficult to deploy.

These technologies help defend against several advanced attack vectors, including boot-level modifications, vulnerable kernel drivers, and Direct Memory Access (DMA) abuse, while allowing Vanguard to verify system integrity more efficiently.

Microsoft Collaboration Enables The Change

A key part of the update is Microsoft's new Runtime Driver Attestation capability, introduced in Windows 11 25H2. This feature allows Vanguard to verify which drivers have been loaded since boot without requiring its own driver to remain active throughout the entire Windows session.

According to Riot, this improvement finally makes an On-Demand architecture practical while maintaining strong protection against kernel-level attacks and vulnerable drivers. :contentReference[oaicite:4]{index=4}

Riot Continues Targeting Advanced Cheat Methods

Riot's latest technical overview highlights several categories of modern cheating that continue to receive significant attention, including kernel-level cheats, Direct Memory Access (DMA) hardware, pre-boot attacks, and computer vision (pixelbot) software.

Rather than focusing solely on detecting individual cheats, Vanguard increasingly emphasizes preventing the underlying techniques used to compromise Windows, making entire classes of cheats more difficult to operate regardless of the specific software being used.

Looking Ahead

Riot describes Vanguard Pre-Check as the beginning of a longer-term security strategy centered around trusted hardware and modern operating system protections. While the new requirements remain optional for most players today, Riot indicates additional security checks may gradually be introduced for the highest levels of competitive play as the PC ecosystem continues to adopt newer hardware and Windows security features.