Field Guide · Anti-cheat

Riot Vanguard

Riot Vanguard is Riot's kernel-mode anti-cheat for Valorant and League of Legends. By default it loads at every Windows boot whether or not a Riot game is running, in contrast to most PC anti-cheats, which load only while their protected game is open. Since June 24, 2026, PCs that pass Riot's optional Vanguard Pre-Check (Windows 11 25H2 or newer with Secure Boot, TPM 2.0, IOMMU, VBS, and HVCI) can switch it to an on-demand mode that starts with a Riot game and stops after play. Its firmware asks differ by game, so this guide records them on each title: Valorant requires TPM 2.0 and Secure Boot on Windows 11, and Riot says League does not require Secure Boot. The user-mode service (vgc.exe) and tray (vgtray.exe) are catalogued in the Field Guide's processes section; the kernel driver, vgk.sys, is not on the public vulnerable-driver list the drivers section folds from. Corrected 2026-10-20: this entry used to say vgk.sys is catalogued in the Field Guide, and listed Secure Boot and TPM 2.0 as Vanguard's own firmware ask. vgk.sys is not catalogued, and that ask is Valorant's, not League's.

kernel · always-onLoads a kernel driver at boot and keeps it running, even when you are not playing.

How it loads

At every Windows boot

Firmware it asks for

Varies by title: Secure Boot, TPM 2.0 on 1 of 2

Games catalogued

Catalogued as of

October 2026

What it can and cannot see

Riot Vanguard runs in the kernel of the machine it is installed on, and in its default mode, because it loads at every Windows boot, it is watching the driver and process surface even when no Riot game is open. In on-demand mode it instead relies on Windows' boot protections and a Runtime Driver Attestation Report, which lists every driver loaded since startup, until a game launches. On that machine it can see loaded drivers, running processes, and memory to the depth its design reaches. It cannot see a second computer, a capture card, or a hardware device placed between your mouse or keyboard and the port it plugs into.

The same boundary applies to every anti-cheat here. Anti-cheat that runs on your PC can examine what happens on that PC, to the depth its design allows. It cannot see a second computer, a capture device, or hardware placed between an input device and the port it plugs into. That is why the presence of an anti-cheat is not, on its own, proof of anything about a player, in either direction. Vera describes what runs; it does not decide what it means.

The processes you'll see

The user-mode processes this anti-cheat runs, the ones that show up in your own process list. Each is catalogued in the Field Guide's processes section:

vgc.exe vgtray.exe

Games that use it

League of Legends

Riot Games·kernel · always-on

Valorant

Riot Games·kernel · always-on

Source

Catalogued by Vera from the anti-cheat maker's own documentation and named public reporting (Ars Technica, PC Gamer, Eurogamer, BleepingComputer, and others). Anti-cheats change; these notes reflect the public record as of October 2026. What is here is public evidence, never an accusation about a person.