Vanguard Anti-Cheat: How Riot Protects Valorant

Riot Vanguard: The Most Aggressive Anti-Cheat in Gaming

When Riot Games launched Valorant in 2020, they made a controversial decision: ship it with Vanguard, a kernel-level anti-cheat that runs from the moment your PC boots until you shut it down. Six years later, Vanguard remains the most aggressive and effective anti-cheat system in gaming. It has fundamentally changed the cheating landscape, making Valorant one of the hardest games to cheat in. But "hardest" doesn't mean "impossible."

This guide explains how Vanguard works, why it's so effective, the privacy concerns it raises, and the techniques that CheatBay sellers use to bypass it.

Vanguard's Architecture: Why It's Different

Unlike EAC or BattlEye, which activate when you launch the game, Vanguard loads at system boot and runs continuously. This design choice has massive implications:

Boot-Time Driver (vgk.sys)

Vanguard's kernel driver loads as an early boot-start driver, meaning it initializes before most other software. This gives it a critical advantage: it can monitor the entire boot chain and detect if any cheats loaded before it. The driver is signed with Riot's EV certificate and loaded through Windows' legitimate driver infrastructure.

Always-On Monitoring

Because Vanguard runs from boot, it creates a continuous chain of trust. If you load a cheat driver, then reboot and launch Valorant, Vanguard knows the system was in a clean state since boot. Many cheat bypasses that work against other anti-cheats fail against Vanguard because they rely on loading before the anti-cheat—which isn't possible when the anti-cheat loads at boot.

Tray Agent (vgtray.exe)

The user-mode component that communicates with the kernel driver and Riot's servers. It handles heartbeat checks, telemetry reporting, and game-specific integrity verification. You can see it in your system tray with the Vanguard shield icon.

TPM and Secure Boot Requirements

Since mid-2024, Vanguard requires TPM 2.0 and Secure Boot to be enabled. This prevents common kernel bypass techniques like disabling Driver Signature Enforcement or loading unsigned boot drivers. The TPM requirement also enables hardware-backed attestation—Vanguard can verify the integrity of the boot chain through the TPM chip.

🔍 What Vanguard Detects

Vanguard's detection capabilities are extensive:

Kernel Driver Monitoring

Vanguard maintains a blacklist of vulnerable drivers commonly used for kernel exploits (the BYOVD technique). It blocks loading of these drivers entirely, not just detecting them. As of 2026, the blocklist includes over 300 drivers. Beyond the blocklist, Vanguard monitors for any unsigned drivers and drivers with suspicious behavior patterns.

Memory Integrity

Continuous hashing of Valorant's code sections, checking for inline hooks, VMT (Virtual Method Table) modifications, and code patches. The checking frequency is higher than other anti-cheats—approximately every 5-15 seconds during gameplay versus 30-120 seconds for EAC.

Debugging Detection

Vanguard aggressively detects debugging tools. If a kernel debugger (WinDbg, KD) is attached or was recently attached, Valorant will refuse to launch. User-mode debuggers attached to the Valorant process are detected and blocked. Even debugger artifacts left in memory can trigger detection.

Virtualization Detection

Running Valorant in a virtual machine is blocked. Vanguard detects VMware, VirtualBox, Hyper-V, KVM, and custom hypervisors through multiple methods including CPUID timing analysis, hypervisor brand string detection, and hardware fingerprinting. This prevents cheaters from using VM snapshots for quick recovery after bans.

System Integrity Verification

Vanguard checks the integrity of Windows kernel structures (SSDT, IDT, GDT), critical system DLLs (ntdll.dll, kernel32.dll), and security features (Patch Guard, HVCI). Modifications to any of these trigger detection.

Hardware Fingerprinting

Extensive hardware ID collection including motherboard serial, CPU ID, GPU serial, disk serials, network adapter MACs, RAM serial numbers, and even monitor EDID data. This creates a comprehensive hardware fingerprint that's extremely difficult to fully spoof.

How Cheats Bypass Vanguard

Despite Vanguard's strength, cheats for Valorant exist and some maintain undetected status for months. Here are the techniques used:

EFI/UEFI Bootkit Approach

The most effective Vanguard bypass operates below the operating system entirely. An EFI bootkit modifies the UEFI boot process to load cheat code before Windows starts—and therefore before Vanguard initializes. This code can:

• Patch Vanguard's driver in memory before it initializes
• Set up hidden memory regions that Vanguard's driver doesn't know to scan
• Intercept Vanguard's boot-time integrity checks and return clean results

The challenge: Secure Boot enforcement means the bootkit must either exploit a Secure Boot vulnerability or require the user to disable Secure Boot (which Vanguard may detect). Some providers use signed EFI shims or exploit vulnerabilities in specific motherboard UEFI implementations.

DMA Hardware Cheats

PCIe-based DMA devices remain effective against Vanguard because they read memory at the hardware level. Vanguard's software cannot detect a PCIe device reading memory through DMA. However, Riot has implemented countermeasures:

• Encrypted memory regions for sensitive data like player positions
• IOMMU enforcement to restrict DMA access
• PCIe device enumeration to detect known FPGA vendor IDs
• Memory access pattern analysis through cache timing

DMA cheat developers counter these by using custom FPGA firmware that spoofs vendor IDs, randomizes access patterns, and decrypts memory regions using keys extracted from the Valorant process.

Signed Driver Exploitation

While Vanguard blocks hundreds of known vulnerable drivers, new exploitable signed drivers are discovered regularly. Cheat developers find signed drivers with write-what-where vulnerabilities or arbitrary code execution bugs, using them to load cheat code into kernel memory. When Vanguard adds a driver to its blocklist, developers switch to a new one.

Hypervisor-Based Approaches

Custom hypervisors that load before Vanguard can intercept its detection mechanisms. The hypervisor virtualizes the CPU, presenting a clean view to Vanguard while hiding cheat activity in a parallel execution context. The difficulty is avoiding Vanguard's hypervisor timing detection—each CPUID instruction and VM exit adds measurable latency.

External Software Cheats

The simplest but riskiest approach: running a cheat that reads Valorant's memory from a separate process using kernel-level memory reading (to avoid Vanguard's user-mode API monitoring). These cheats typically have shorter undetected lifespans but are cheaper and more accessible.

Vanguard Ban System

Vanguard's ban system is multi-tiered:

• Game ban: Permanent ban on the Valorant account. No appeal for cheat-related bans.
• Hardware ban: Bans the hardware fingerprint. New accounts on the same hardware are banned within minutes to hours.
• Delayed bans: Riot sometimes delays bans to collect data on the cheat being used. You might play for 1-2 weeks before a ban wave hits.
• Ranked restrictions: Suspected cheaters may be silently restricted from ranked play before a full ban is issued.

The Privacy Debate

Vanguard's always-on kernel access has been controversial since launch. Concerns include:

• Scope: A kernel driver running 24/7 has access to everything on your PC, not just when playing Valorant
• Attack surface: A vulnerability in Vanguard could be exploited by malicious actors for privilege escalation
• Data collection: Riot (owned by Tencent) collects hardware telemetry that some users consider invasive
• System stability: Vanguard has caused compatibility issues with legitimate software, hardware drivers, and even overclocking utilities

Riot has addressed some concerns by allowing users to disable Vanguard (you just can't play Valorant until it's re-enabled and you reboot), but the fundamental tension between security and privacy remains.

Tips for Cheating in Valorant

If you choose to cheat in Valorant, these practices maximize account lifespan:

1. Never use free cheats: Vanguard detects free/public cheats within hours. Only paid, private cheats with active development have a chance.
2. HWID spoofer is mandatory: Without one, a ban locks you out permanently on that hardware.
3. Play legitimately between cheat sessions: Mix cheated and clean games to muddy your statistical profile.
4. Keep your rank realistic: Don't go from Iron to Immortal in a week. Gradual progression draws less scrutiny.
5. Use subtle settings: Low FOV aimbot, chest-only targeting, minimal ESP. Rage settings guarantee fast detection.
6. Monitor detection status: Check your provider's status page daily. If detection is reported, stop playing immediately.

Pricing for Valorant Cheats

Due to Vanguard's difficulty, Valorant cheats are among the most expensive:

• Software cheats: $40-80/month for kernel-level solutions
• DMA cheats: $200-500 for hardware + $30-60/month for software
• HWID spoofer: $15-30/month (often bundled)
• Private/exclusive slots: $100-200/month for limited-user cheats

Conclusion

Vanguard is a formidable opponent. Its boot-time initialization, continuous monitoring, TPM requirements, and aggressive detection methods make it the toughest anti-cheat to bypass. But the cat-and-mouse game continues: EFI bootkits, DMA hardware, and creative kernel exploitation keep the cheat scene alive. The cost of entry is high—both financially and technically—but for those willing to invest in quality solutions from trusted providers, Valorant cheating remains possible in 2026.