Riot makes Vanguard on-demand, stopping kernel anti-cheat at boot for most players

Riot is giving League of Legends and Valorant players an option they have wanted since Vanguard launched in 2020: Vanguard anti-cheat will stop running at PC boot and instead start only when you are playing a game. After the update goes live later today, Vanguard will operate in “on-demand” sessions, meaning the driver component will no longer launch when the system starts, and it will shut down once gameplay is over.

Riot frames this as a privacy and convenience upgrade, but the fine print is the whole story. “On-demand” in this context refers to disabling Vanguard’s driver component at system start, while “secured” means only certain machines can use the change. Riot’s anti-cheat chief Phillip Koskinas said that on-demand support will begin from “all sufficiently secured PC devices,” and Riot estimates that roughly 35% of its players already satisfy the required conditions. So for a large chunk of the player base, this update is effectively a switch that shows up automatically. For everyone else, the option is gated by a list of modern security features and, potentially, some time in the BIOS.

To understand why this is a big deal, you have to remember what Vanguard is in the first place. Vanguard was controversial at launch because it is “kernel mode” software, which in theory gives Riot access to a remarkably deep layer of the operating system. Beyond the access level, the original setup was also “effectively omnipresent”: Vanguard launched when your PC did and ran quietly in the background. Riot compares its approach to other kernel-mode anti-cheats used by games like Genshin Impact, Doom Eternal, and Call of Duty games, which typically run only while the game is running and terminate when the game does. This update is Riot moving closer to that model, but with an important constraint: the system has to be “secured” enough to allow Vanguard to safely start and stop.

Riot is not claiming it will let you turn Vanguard off because “it feels nice.” It is claiming it can safely end its “watch” if your device has opted into pre-boot security mechanisms and Windows’ native protection features. Koskinas’ explanation points to the broader PC security stack that has been rolling forward for years, especially cryptographic verification of boot processes and kernel integrity. He said that the needed features were not available until fairly recently, and Riot collaborated with Microsoft’s Xbox OS Security Team to make improvements in the Windows kernel that now allow on-demand mode within Vanguard.

The eligibility requirements are specific. For most players trying to use the on-demand option, Riot says you need to be running Windows 11 25H2 or later, and have UEFI Secure Boot, TPM 2.0, VBS, HVCI, and IOMMU switched on. Riot also notes that there is a “Pre-Check” step, which likely evaluates whether your device meets those conditions before it exposes the on-demand option. If you are not already there, expect some tinkering in the BIOS, which may or may not sound like fun, depending on how much you enjoy debugging firmware settings. Riot also clarifies the edge case: about 3% of Riot players are on older hardware that cannot meet the Pre-Check requirements. For those players, the on-demand option will not be available unless and until they upgrade.

Here is the strategic nuance for leaders watching this space: Riot is not rolling out a universal “turn it off” button. It is segmenting who gets frictionless behavior based on device security readiness. Koskinas said roughly 35% of players qualify immediately and the option appears automatically after the update, but the remaining eligible path depends on enabling security features. Riot is also explicit that it is not forcing changes right now: Vanguard will continue to operate as it is for the foreseeable future, and Riot says “We’re not making anyone change anything. We’re willing to wait until the ecosystem matures.” That is a commercial and reputational balancing act. Riot can reduce the always-on objection for compliant machines, while avoiding a backlash from players on older systems or from those who simply do not want to touch their settings.

Finally, Riot is tying this to the threat environment. Koskinas said that as botting becomes increasingly complex and accessible with the advent of AI, Riot will keep advancing its anti-cheat efforts. His conclusion matters because it shows the direction of travel: friction is not fun, so Riot prefers “incentives to requirements,” and it plans to keep the checks optional until you’re in the most competitive segments, on “the strangest devices,” or among the highest ranks. In other words, expect more conditional enforcement over time, not less. For boards, investors, and operators in gaming and adjacent sectors, the second-order implication is straightforward: PC security baseline requirements are becoming a product lever. And once anti-cheat turns from “always-on driver” into “on-demand plus trust segmentation,” the governance question becomes which machines and which players get which experience.