Field Guide · Anti-cheat

Riot Vanguard

Riot Vanguard is Riot's kernel-mode anti-cheat for Valorant and League of Legends. Notable for loading at every Windows boot regardless of whether a Riot game is running, in contrast to most PC anti-cheats which load only while their protected game is open. The kernel driver (vgk.sys) and user-mode service (vgc.exe) are both catalogued in the Field Guide.

kernel · always-onLoads a kernel driver at boot and keeps it running, even when you are not playing.

How it loads

At every Windows boot

Firmware it asks for

Secure Boot, TPM 2.0

Games catalogued

Catalogued as of

June 2026

What it can and cannot see

Riot Vanguard runs in the kernel of the machine it is installed on, and because it loads at every Windows boot it is watching the driver and process surface even when no Riot game is open. On that machine it can see loaded drivers, running processes, and memory to the depth its design reaches. It cannot see a second computer, a capture card, or a hardware device placed between your mouse or keyboard and the port it plugs into.

The same boundary applies to every anti-cheat here. Anti-cheat that runs on your PC can examine what happens on that PC, to the depth its design allows. It cannot see a second computer, a capture device, or hardware placed between an input device and the port it plugs into. That is why the presence of an anti-cheat is not, on its own, proof of anything about a player, in either direction. Vera describes what runs; it does not decide what it means.

The processes you'll see

The user-mode processes this anti-cheat runs, the ones that show up in your own process list. Each is catalogued in the Field Guide's processes section:

vgc.exe vgtray.exe

Games that use it

League of Legends

Riot Games·kernel · always-on

Valorant

Riot Games·kernel · always-on

Source

Catalogued by Vera from the anti-cheat maker's own documentation and named public reporting (Ars Technica, PC Gamer, Eurogamer, BleepingComputer, and others). Anti-cheats change; these notes reflect the public record as of June 2026. What is here is public evidence, never an accusation about a person.