Kernel drivers operate at the highest privilege level in Windows. They are a common leverage point for bypassing game anti-cheat systems. Vera inventories loaded drivers and checks them against known-risk lists.

Attackers often exploit legitimate but vulnerable signed drivers to gain kernel access. Vera tracks known-risk drivers that have been abused in bypass ecosystems.

Driver presence is 'Observed' (captured directly). Known-risk matches are 'Correlated' (derived from catalog rules). Both require human review and context.

Vera uses terms like 'risk indicator', 'requires review', and 'not a verdict'. Driver matches are flags for investigation, not accusations.